Safety summary

What happened

On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was participating in an air display as part of the City of Perth Australia Day Skyworks event. On board were the pilot and a passenger. The pilot of CQA was flying ‘in company’ with a Cessna Caravan amphibian and was conducting operations over Perth Water on the Swan River, that included low-level passes of the Langley Park foreshore.

After conducting two passes in company, both aircraft departed the display area. The pilot of CQA subsequently requested and received approval to conduct a third pass, and returned to the display area without the Cessna Caravan. During positioning for the third pass, the aircraft departed controlled flight and collided with the water. The pilot and passenger were fatally injured.

What the ATSB found

The ATSB found that the aircraft aerodynamically stalled during a positioning turn for the third pass, resulting in the collision with shallow water. The manner in which the pilot returned to the display area after the second pass was not in accordance with the display procedures and increased the risk of mishandling the aircraft in an area of relatively close proximity to the public. The pilot’s decision to carry a passenger was also contrary to the requirements of the display instrument and increased the severity of the outcome.

Finally, a safety issue was identified with the current regulatory framework for air display approval and oversight.

What's been done as a result

The Civil Aviation Safety Authority had independently published a revised manual of guidance for air displays in September 2017. The document provided further detail on the key roles and their responsibilities and introduced a requirement to conduct a risk assessment as part of the application process. In April 2018, CASA updated the associated participant form, which was expanded to assist pilots with their display preparation and included a requirement to identify and provide justification for any additional persons on board display aircraft. The form also included a section to provide additional assurance around completion of the display coordinator’s responsibilities.

Finally, the ATSB has issued a safety recommendation to CASA to undertake further work to enhance their tools and guidance for air display approval and oversight, and procedures to ensure the suitability of those responsible for organising, coordinating and participating in air displays.

Safety message

Air displays are activities with inherent and unique risks that pilots, the organisers and the regulators all have responsibilities in addressing. It is important that holders of these key positions have a thorough understanding of their role and responsibilities, to ensure adequate completion of safety critical tasks. Having well-defined, transparent and consistent processes for planning and approval of air displays will assist in identifying risks and implementing effective mitigation strategies.

In addition to complying with regulations, pilots can limit their risk exposure by only participating in displays that are within their own and their aircraft’s capabilities and limitations, and not undertake any impromptu manoeuvres that have not been planned or practiced.

These steps combined will provide greater safety assurance for participants, spectators and the general public.

VH-CQA

Source:  Flightaware.com

The occurrence

On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was preparing to participate in an air display as part of the City of Perth Australia Day Skyworks (Skyworks) event.

The pilot of CQA and a passenger arrived at Serpentine Airfield, 48 km south of Perth (Figure 1), at about 1500 Western Standard Time,^[1] to prepare the aircraft for flight. The pilot was reported to have used his mobile phone to discuss aircraft performance with another individual and subsequently unloaded some equipment to reduce the aircraft’s weight. At about 1625, once the pilot had confirmed via phone the take-off calculations for the runway length and local temperature of about 42˚C, he and his passenger, who did not have any pilot qualifications, boarded CQA.

The pilot was in the left seat and the passenger in the right seat. CQA departed from runway 23 and tracked out towards the coast. The pilot of another aircraft returning to Serpentine Airfield observed CQA’s departure and described it as a ‘long and slow climb’, which they surmised was due to a combination of the high ambient temperature and the aircraft’s inherent performance.

The pilot of CQA planned on flying ‘in company’ (see the section titled Procedure for fly‑bys) with a Cessna Aircraft Company C208 ‘Caravan’ amphibian, registered VH-MOX (MOX) during the air display. The pilot of MOX received a text message from CQA’s pilot, advising that he would not be landing at Jandakot Airport as previously discussed and requested that they meet up overhead the agreed alternative location of Cockburn Sound (Figure 1). MOX departed from Jandakot at about 1645 and met up with CQA over Cockburn Sound.

Upon meeting up, the pilot of CQA assessed that MOX’s speed was too high for the two aircraft to travel together and requested that the Caravan pilot slow his aircraft down. The pilot of MOX agreed to slow down with a request that CQA ‘didn’t get too close’. Both aircraft then flew the prescribed route to Perth Water, the location of the air display. The weather was fine with a recorded wind of about 20 km/h from the south-west and a temperature of about 39°C.

Figure 1: CQA and MOX flight path

Source: Google Earth, modified by ATSB

Once approved to enter the display area, CQA followed MOX via the prescribed inbound route to the north of Perth city in order to conduct a fly-by parallel to the Langley Park foreshore in a westerly direction (Figure 2). MOX conducted a splash‑and‑go^[2] in front of Langley Park while CQA followed at about 200 ft above the water. The delay associated with MOX’s splash-and-go resulted in the separation between MOX and CQA reducing. MOX lifted from the water surface, entered a climbing turn and conducted a left orbit^[3] within the confines of Perth Water to reposition for a second pass of Langley Park.

Flight data and video footage showed that CQA took longer to initiate the left orbit and subsequently flew at about 500 ft over the built-up area of the South Perth peninsula that connects to the Narrows Bridge, at the western end of Perth Water. CQA then descended to about 200 ft over the south of Perth Water while repositioning for a second pass.

Figure 2: CQA air display flight track, showing the first pass in yellow, the second in magenta and the third in red

Source: Google Earth, modified by the ATSB

When MOX conducted its second splash-and-go in front of Langley Park, CQA was about half an orbit behind, flying in an easterly direction along South Perth foreshore. Following completion of the splash‑and‑go, the pilot of MOX climbed over the Narrows Bridge to about 1,000 ft for the return flight to Jandakot. CQA’s second fly-by of Langley Park was lower than the first, descending to just above the water surface, before a climb was also initiated to clear the Narrows Bridge.

On departure from Perth Water, the pilot of MOX transmitted on the display frequency that he was exiting the display area and returning to Jandakot Airport. CQA flew over the Narrows Bridge and initially followed MOX toward Jandakot, during which time the pilot requested approval to conduct a third pass. This request was authorised via radio by the ‘Ringmaster’,^[4] but as the pilot of CQA did not hear the authorisation, MOX re‑transmitted the approval to CQA, while continuing with their own departure. CQA then conducted a left turn and returned directly to Perth Water, at about 300-400 ft over the built-up area and moored spectator boats.

CQA flew in an easterly direction, parallel with the South Perth foreshore, before commencing a left turn towards Langley Park to position for the third pass. The aircraft was at a similar altitude to the first orbit at the commencement of the turn, but was slower and positioned further towards the middle of Perth Water (Figure 3). Video and still imagery recorded that the wing flaps were in the retracted position. The left turn was tighter than that of the first orbit and during that turn, CQA rolled left and pitched nose-down, consistent with an aerodynamic stall^[5] (Figure 4). The aircraft collided with the water and was destroyed. The pilot and passenger were fatally injured.

Immediately after the accident, the remainder of the air display was cancelled, followed shortly after by cancellation of the entire Skyworks event.

Figure 3: CQA's pass along South Perth, just prior to the final left turn

Source: David Roses

Figure 4: CQA just prior to the collision with water (looking north)

Source: Mike Graham

__________

1. Western Standard Time (WST): Universal Coordinated Time (UTC) + 8 hours.
2. A splash-and-go is a manoeuvre whereby the aircraft descends until the floats/hull briefly contacts the water surface, before climbing away.
3. An orbit is generally recognised as a 360˚ turn at a constant altitude, however this was the terminology used for the air display with respect to the manoeuvres within Perth Water and has been used in this report for consistency.
4. See the section titled Air display roles and responsibilities.
5. Aerodynamic stall: occurs when the airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically greater than 16˚ to 18˚, and results in reduced aerodynamic lift.

Context

Pilot information

The pilot held a Private Pilot (Aeroplane) Licence issued in July 1994, and a current Class 2 Aviation Medical Certificate. His endorsements included floating hull, manual propeller pitch control and retractable undercarriage, and he held single- and multi-engine ratings. The pilot completed his floating hull endorsement in October 2011 on a LA-4-200 Lake Buccaneer Amphibian. In 2012, he completed about 18 hours of flight training^[6] in the Grumman American Aviation Corp G-73 Mallard (Mallard) in the United States, under his Federal Aviation Administration (FAA) licence.

The pilot accrued about 21 hours on VH-CQA (CQA) between 6 and 13 January 2017. Prior to that, he had not flown any aircraft since 29 August 2016. The pilot conducted no further flights until 26 January 2017. At the time of the occurrence, the pilot’s logbook indicated that he had 625 hours flying experience, with about 180 hours in the Mallard.

The pilot had accrued 136 water landings, of which 84 were completed over the two days of his floating hull endorsement. The pilot’s Mallard water landing experience consisted of 37 landings during dual training and 11 while solo. The pilot’s most recent water landing (which was in CQA) was conducted on 28 February 2016.

Post‑mortem examination and toxicological analysis of the pilot and passenger did not identify anything that may have contributed to the accident.

Mallard rating and flight reviews

The pilot’s Mallard training in the United States, was completed on 25 May 2012 and was conducted on the same aircraft that was later registered as VH-CQA (see the section titled Aircraft information). The pilot’s log book was endorsed as ‘training completed’ and ‘unrestricted land and sea use of the G73’ and he commenced flying the Mallard solo, in Australia on 30 July 2012.

Due to an administrative error during conversion of the pilot’s United States flight crew licence, his Civil Aviation Safety Regulations (CASR) Part 61 licence was not issued with a G-73 rating. This was identified by the Civil Aviation Safety Authority (CASA) during the air display application process. The pilot applied for the G-73 rating on 19 January 2017 and his licence was reissued with the type rating on 24 January 2017.

CASA Instrument 186/14 published on 25 August 2014, introduced prescribed aircraft, ratings and variants for the CASR Part 61 licencing system. On 23 December 2014, CASA published Prescription of aircraft and ratings – CASR Part 61, identifying those aircraft considered sufficiently complex or having performance or handling techniques that warranted initial specific training and per-type flight reviews. Schedule 6 of this document identified the Grumman G‑73 Mallard as a type-rated aircraft.

The pilot’s most recent biennial flight review was conducted in April 2016 in a Piper PA-30 Twin Comanche. The flight review prior to that (April 2014) was also conducted in the PA-30. An exemption to CASR Part 61, EX97/16, allowed for a multi-engine aeroplane class rating flight review to satisfy the flight review requirement for a type-rated multi-engine operation. The pilot therefore satisfied the flight review requirement to fly the Mallard, but had not had a review in the aircraft type since his endorsement.

Despite the exemption, all pilots were subject to the CASR 61.385 ‘general competency rule’, which indicated that a pilot is only authorised to fly an aircraft if they are competent to the standards mentioned in the CASR Part 61 Manual of Standards. Outside of the requirement for flight reviews, the pilot was responsible for ensuring his competence to fly the aircraft.

The instructor who provided the pilot’s floating hull endorsement training flew with him again in April 2015, this time in the Mallard. He recalled the pilot as being ‘generally pretty good’, but that he ‘wasn’t quite up to speed with the aeroplane’ and suggested that this may have been due to the pilot’s irregular flying.

Air display experience

The pilot participated in several air displays whilst flying CQA, including the:

• Great Eastern Fly-In (GEFI) events at Evans Head Aerodrome in New South Wales in 2015, 2016 and 2017.
• Brisbane Valley Air Show (BVAS) at Watts Bridge Memorial Airfield, Queensland in 2016.

The programs for these events indicated that the pilot demonstrated a ‘handling display’. Review of video footage showed that the displays included one or more straight and level fly-bys with repositioning turns for return passes.

The pilot’s application to take part in the Perth air display described the proposed display as ‘same display as used previously at GEFI and BVAS, minimum height 300 ft, no aerobatic manoeuvres, multiple passes, no ‘dirty pass’,^[7] all within normal operating manual’.

Familiarity with the Perth Water air display area

On 13 January 2017, during CQA’s repositioning from New South Wales to Western Australia, the pilot undertook a flight from Esperance to the north of the Perth metropolitan area and then tracked south along the coast before turning inland, toward Perth city. During this time, the aircraft flew in an easterly direction along the Langley Park foreshore at about 1,000 ft, before turning right prior to the Causeway Bridge (Figure 6). CQA was then flown in a westerly direction toward the south Perth peninsula, where the aircraft tracked toward Fremantle, then down the coast toward Serpentine Airfield. The pilot did not fly CQA again until the air display on 26 January 2017.

Aircraft information

The Grumman American Aviation Corp G-73 Mallard is a high-wing, medium-sized amphibious aircraft^[8] with under-wing floats, retractable landing gear and two-step hull (Figure 5). It was powered by twin Pratt & Whitney R-1340 Wasp radial engines. The Mallard was designed for regional airline operations with two pilots and ten passengers. Fifty-nine aircraft were built between 1946 and 1951.

Mallard serial number J-35 was built in 1948 in the United States and was first registered in Indonesia that same year. In 1976, the aircraft was relocated to the United States and operated there before the occurrence pilot purchased it and transferred it to Australia in July 2012. The aircraft was then based at Evans Head Airfield, New South Wales.

Figure 5: VH-CQA

Source: David Roses

The aircraft flew in Australia under its United States registration until it was re‑registered as VH‑CQA (CQA) in July 2013. In August 2013, CQA was issued with a Special Certificate of Airworthiness in the Experimental – Exhibition category with defined operating requirements. This included that any passengers were to be made aware that the design, manufacture and airworthiness of the aircraft was not required to meet any standard recognised by CASA and that flight in the aircraft was at their own risk. In addition, warning placards detailing this information were to be placed in full view of all passengers.

Flight characteristics and performance considerations

The ATSB sought the input of two experienced Mallard pilots and a CASA-authorised flight analyst in order to gain appreciation of the flight characteristics of the Mallard and its performance considerations. It was commented that the Mallard could easily be operated by one pilot. However, it was also mentioned that because it has a constant-angle, high performance wing^[9] it ‘requires more care than with a wing that provides more lift at a slower speed’, particularly as a stall can result in the aircraft going ‘straight onto its back’.

Maintenance history

CQA was maintained in accordance with a CASA-authorised System of Maintenance (SOM). This SOM was effective as at May 2013 and the aircraft was required to undergo a conditional ‘periodic’ inspection every 12 months or 100 hours, whichever came first. CQA was maintained by a CASA-authorised maintenance provider, who conducted a periodic inspection and issued the current maintenance release, on 6 January 2017. At the time of the accident, the aircraft had accumulated about 22 hours since that periodic inspection and had a total time in service of 7,336 hours.

As CQA was reportedly being relocated to Western Australia, the maintainer released the maintenance log books to the pilot. However, they could not be located following the accident and the maintenance history could therefore not be reviewed by the ATSB. Information from CASA and other sources did not identify evidence of any previous accidents involving the aircraft.

An installed autopilot was removed from CQA as part of Supplemental Type Certificate SA635SO, prior to its delivery to Australia. Removal of that equipment reduced the maximum certificated take-off weight to 5,700 kg. The aircraft flight manual authorised the G‑73 for single-pilot operation^[10] and CQA’s instrument panel was set up for left-seat, single-pilot operations.

CQA was not fitted with a stall warning device^[11] and there was no requirement for one.

VH-MOX and flight crew information

VH-MOX (MOX) was a Cessna Aircraft Company 208 ‘Caravan’ that was manufactured in 1993 and first registered in Australia in 1994. The Caravan is an all-metal, high-wing aircraft that is powered by a single Pratt & Whitney PT6A turboprop. MOX was fitted with floats with retractable landing gear to allow for land and sea operations. The Caravan had a maximum take‑off weight of about 3,600 kg.

The flight crew of MOX consisted of the pilot in command (PIC), in the left seat, and an observer, in the right seat. The PIC held a current instrument and Grade 1 instructor rating and had extensive float experience operating Caravans. The PIC also had commercial Caravan operations experience within Perth Water and had operated the aircraft there in the week prior to the air display. In addition, the PIC had previous experience participating in the Perth Air Display.

The observer was a pilot with significant experience in float planes and floating hull aircraft, at Perth Water and other locations. He held a Grade 1 instructor rating and had over 27,000 hours flying experience. In addition, he had previous air display experience in light aircraft. Both pilots had low-level endorsements, with recent experience, and had flown with each other previously.

Meteorological information and water conditions

The Bureau of Meteorology reported the weather conditions for 26 January 2017 were ‘fine, very hot and sunny’ with temperatures reaching 42˚C in the Perth area^[12] during the day. Perth Airport records for 1500 indicated the temperature was 41.5˚C with a relative humidity of 9 per cent. Wind speed and direction recordings from nearby Melville Water indicated a wind speed of about 11 knots from 226˚ (20 km/h from the south‑west). Pilots in the air display described the water condition as ‘ideal’, not glassy, with small ripples to assist with depth perception and wind direction identification.

The sun was low in the sky to the west and was unlikely to have affected the pilot’s visibility immediately prior to the collision, when the aircraft was flying east and then turning north.

Recorded data

Analysis of available track data (as depicted in Figure 2) found that the Mallard’s speed on entry to the accident turn was approximately 10 kt slower than at the equivalent point in the previous orbit and within around 10 kt of the aircraft’s stall speed for a coordinated turn at an estimated 30° angle of bank at the commencement of the turn.

Site and wreckage information

CQA collided with water on the Swan River, in a shallow section, approximately mid-way between the Langley Park and South Perth foreshores and about 700 m west from The Causeway. A navigable channel had been dredged parallel with the Langley Park foreshore, the remainder of Perth Water was relatively shallow, with a layer of silt. The mostly‑submerged wreckage was recovered and transported by barge to a nearby secure facility for technical examination.

Damage to the aircraft was consistent with the observed collision with water in a steep nose-down attitude and subsequent contact with terrain, about 1.5 m below the surface. Examination of the wreckage did not identify any evidence of in-flight break‑up, component failure or other anomalies that may have contributed to the collision with terrain, or that would have prevented the engines and propellers from operating normally. This was consistent with witness reports, images and video of the aircraft during the display.

Conduct of the air display

Overview

The City of Perth (CoP) managed the Australia Day Skyworks (Skyworks), which consisted of a series of events on 26 January each year, culminating in a fireworks display from barges moored in the centre of Perth Water (Figure 6). Perth Water is located on the Swan River between Langley Park and the South Perth shoreline, the Narrows Bridge in the west and Causeway in the east. Events included various activities on the Langley Park foreshore and the South Perth foreshore, which was coordinated by the City of South Perth. Water-based events and the air display were managed on behalf of CoP by a contracted events management company. Up to 300,000 people attended each year.

The air display had been a part of the Australia Day activities since 1993. The event was originally organised by an individual, then through the Royal Aero Club of Western Australia, before being incorporated into the CoP’s overall management of the event.

The air display was scheduled to run from 1530 until 2000, before the commencement of the fireworks display. The programme consisted of fly-bys (small vintage aircraft, like Tiger Moths, through to a medium-sized Fokker 100 jet), individual and group aerobatics, banner/flag-towing, aerial displays from water-bombing aircraft and float plane ‘splash-and-go’s’. The participating pilots were mostly volunteers, many of whom had been associated with the event for many years. Several of the pilots also participated in multiple displays on the day.

Figure 6: Perth Water

Source: Google Earth, modified by ATSB

Airspace

Perth Water is located about 10 km west‑south‑west of Perth Airport, in class C airspace. A temporary danger area (TDA)^[13] ‘Area ALPHA’ (Figure 7) was established by Airservices Australia for the duration of the air display, from surface up to 1,500 ft AMSL.^[14] This allowed air display aircraft to operate in Perth Water without the need for specific air traffic control (ATC) clearance. A central point of contact ‑ the Ringmaster ‑ was required to maintain two-way communication with Perth ATC and coordinate aircraft access into Area ALPHA on a specified frequency. Standard airspace procedures were required for operations outside of Area ALPHA.

Figure 7: Google Earth image showing approximate location of Perth Water within Area ALPHA.

Source: Google Earth, modified by ATSB

Air display program and procedures

The CASA-approved air display program documented all participating aircraft, flight crew and routines for the display. Where a routine involved multiple aircraft, one aircraft was designated the ‘lead’ aircraft and would conduct all radio communications on behalf of the group. Each display was scheduled in 10‑15 minute time slots. The display program was often similar to the year before, depending on availability of aircraft. All pilots taking part in the air display were provided with briefing notes, which included a copy of the CASA approval, airspace procedures, air display program and standard display procedures.

Inbound, holding and outbound tracking

The procedures for approach and departure from the display area were detailed in ‘display procedure B2’ (Figure 8). Once aircraft had entered Area ALPHA they were to track toward the holding area XRAY at an altitude of 1,500 ft (D1 INBOUND OUTBOUND HOLDING). If holding was required, aircraft would perform right orbits until they were given clearance by the Ringmaster to track inbound to Perth Water. Unique displays, including aerobatics, entered Perth Water in accordance with their documented routine.

For all non-aerobatic aircraft, the standard inbound route to the display area (Perth Water) was to fly over Kings Park then Northbridge (to the north of Perth City) and via the Graham Farmer freeway toward the East Perth power station (D2 INBOUND DISPLAY AREA). Aircraft descended to 1,000 ft while flying over the Swan River toward the Causeway and Perth Water. Departure from the display area was via the Swan River at 1,000 ft toward Fremantle, until clear of Area ALPHA.

Figure 8: Extract of the CASA‑authorised B2 display procedure supplied to all participants

Source: CASA

Procedure for fly-bys

Fly-bys (procedure D3, Figure 9) were to be performed by groups of aircraft flying ‘in formation’ or ‘in company’. The program noted that ‘formation rated and current pilots [are to] only [fly] in formation groups up to maximum of 6. Other aircraft [including those operating in company] were to maintain 600 metre separation between each other’.

Figure 9: Extract from the ‘display procedures – B2’ diagrams, showing the arrow that indicates the direction and location of the float plane landing area

Source: CASA

Following the standard approach and departure procedure, aircraft conducting fly-bys were to descend from 1,000 ft to not below 500 ft over the channel of water between the pyrotechnic barges (red rectangle, Figure 9) and Langley Park foreshore. The aircraft were to depart over the Narrows Bridge (Figure 6) and track over the Swan River at 1,000 ft, back toward Jandakot Airport.

If additional fly-bys were approved by the Ringmaster, there were two options to re-enter the D2 ’inbound display area’ procedure:

• aircraft could turn right before Kings Park and fly along the freeway on climb to 1,500 ft and re‑join the D2 procedure at the western end of Northbridge, or;
• from the Narrows Bridge they could track along the Swan River and fly over Kings Park on climb to 1,500 ft, before re-joining the D2 procedure at Northbridge.

The standard D3 procedure was to be followed for the remainder of any additional fly-bys. Between one and three fly-bys, per display, had been the standard in preceding years. Fly-bys and multiple passes were not specifically detailed with respect to the float plane procedure.

Procedure for float planes

Float planes had been part of the air display in the past, but not every year. Previous float plane displays had included the Cessna C208 Caravan, a Cessna 206 and a Lake Aircraft LA-4-200 Buccaneer.^[15] The display coordinator (DC)^[16] advised that float planes were added to the air display about 10 years prior to this accident. A representative from CASA observed him demonstrate the intended display in a Cessna 206, before they were approved for inclusion in the display program. The C208 Caravan was the most frequently used aircraft type for this display.

Within Perth Water, the float planes were permitted to descend to the water surface. On some occasions they had landed and back-tracked before turning around and taking off. However, it was reported that when conditions were suitable, float planes were expected to conduct a splash‑and‑go, remaining on the step.^[17] The C208 Caravan float plane procedure submitted to CASA for 2015 and 2017 was essentially the same and is shown in Figure 10.^[18]

Figure 10: Float plane procedure approved by CASA in 2015 and 2017

Source: CASA

A procedure for the Mallard was added to the float plane procedure for the 2017 air display and included ‘touching the water the same as above [the C 208] but without getting off the step’.

Both the floatplane and flying boat procedures contained a contingency to conduct a missed approach while remaining in the display area if water and wind conditions were not suitable. Both procedures also made reference to ’approach…per standard bridge clearance procedure’. There was no reference to what this procedure was, but it was assumed by the ATSB to be the standard approach and departure (B2) procedure.

The B2 display procedure included the ‘D6 Floatplane Landing’ (Figure 9) location at the northern edge of the display box.

Actual conduct of the float plane display

When the float plane display was first introduced, the aircraft would usually land, back-track and then take off. While not documented, the sequence was subsequently altered to a splash-and-go, followed by the left orbit. That variation had reportedly been in place for a number of years.

The float plane procedure in practice was therefore to approach from behind the city to enter Perth Water, conduct a low pass (or splash‑and‑go) at the northern edge of the display box, followed by a left orbit within the confines of Perth Water, before conducting a second pass along the Langley Park foreshore. The float planes would then depart as per the standard procedure or conduct a second left orbit if they were going to do a third pass/splash‑and‑go.

This sequence was consistent with the display briefing given the night before the activity, where the float plane display was described by the DC as follows:

The float planes… will be doing their touch and go…but they won’t be landing fully. If anything they [are] just kissing the water and then do an orbit and then another one and then [depart].

Further, video footage of the briefing showed the DC indicating left orbits on the projected map at this time.

CASA’s understanding of the float plane display sequences

CASA personnel who approved the display advised that they were not aware left orbits within the confines of Perth Water were being conducted during the float plane display. They reported having an understanding that:

• the float planes would conduct the standard approach from behind the city
• perform one low pass, or splash-and-go
• depart via the standard procedure.

They further stated that had they known left orbits were being conducted, they would not have approved a ‘turn into that area in a Caravan, let alone a much larger aircraft’.

The DC advised he had not mentioned the left orbits to CASA as they had never specifically enquired about the float plane sequence. However, CASA staff were present for the briefing conducted the night before the activity, in which the conduct of orbits was described.

Operation within Perth Water

The ATSB spoke with Caravan and Buccaneer float plane pilots who had experience operating within Perth Water and were therefore familiar with the display area. They noted that their aircraft did not have a lot of room to manoeuvre and described Perth Water as a ‘confined’, ‘constricted’ and ‘very tight operating area’.

Air display conditions for conducting the display in Perth Water were captured in the display instrument, and included that:

Non-aerobatic display aircraft are not to be operated below 1.3 times the stall speed for the aircraft’s configuration.

…display aircraft will pass no closer than 200 metres horizontally from spectators. Aircraft below 1500 feet AGL shall not track or manoeuvre directly towards spectators within a horizontal distance of 500 metres.

For aircraft operated by pilots holding a low-flying approval, the demonstration may be conducted with the following manoeuvring limitations:

a) Between 50-200 feet AGL – wings level only

b) Between 200-300 feet AGL – up to 30 degrees angle of bank

c) Between 300-500 feet AGL – up to 60 degrees angle of bank

Despite the differences in understanding of the intended display between CASA and the display participants, and the stated effect on the display approval, the ATSB determined that it was possible to conduct orbits in the Mallard, while adhering to the display conditions, however there was little room for error. A similar conclusion was reached by CASA in their post-occurrence regulatory safety review.

However, following review of the draft investigation report, CASA advised that the conduct of orbits within Perth Water could not be conducted in compliance with Civil Aviation Regulation (CAR) 157. Despite this, the ATSB noted that CASA did approve the conduct of essentially identical manoeuvres in the form of a ‘…go around whilst remaining in the display area’, per the display procedure.

Approval of VH-CQA in the air display

The DC met the pilot of CQA in late 2016. In early 2017, when he became aware the aircraft was coming to Western Australia, he invited the pilot to participate in the air display. In January 2017, leading up to the air display, the following key interactions to facilitate participation of the aircraft and pilot occurred:

• In an email to CASA on 4 January that included documents for the air display application, the DC mentioned the possibility of CQA being involved in the display. The display procedures submitted in this email included one for ‘flying boat’. He also provided details for several display pilots, including the pilot of CQA.
• On 11 January, the DC advised CASA via email that another float plane had been added to the program to fly with CQA. However, a revised procedure detailing this new aircraft was not included in this email.^[19]
• On 12 January, CASA asked the DC if the pilot of CQA was going to get an opportunity to practice prior to the event. He replied that it would be the same as ‘all other displays where pilots will prepare appropriately’, and that he would meet with the pilot of CQA when he arrived in Perth. CASA then requested the pilot of CQA provide a statement in relation to the water depth in the proposed landing area, for the appropriate date and time of the event. The DC replied there would likely be a water depth of about 1 m.
• On 16 January, the DC sent an email to the pilot of CQA where he offered to be ‘co-pilot’ during the display, to ‘help with the radio and procedure’.
• In an email to CASA on 17 January, the DC indicated that he had spoken with the pilot of CQA and agreed that he would only do a splash-and-go and that the aircraft would not get off the step.
• During a phone call on 19 January, the DC was advised by CASA that the pilot of CQA would not be able to participate in the air display without the required G-73 type rating being endorsed on his licence. The DC advised the pilot of CQA of the issue with the type rating via email and that CASA had agreed to wait until midday 23 January when, if no evidence of this type rating was provided, CQA would be withdrawn from the program.
• About a week before the air display, the DC arranged with CASA for MOX to be included in the display and submitted details for the pilot and advised that he was still waiting for confirmation that CQA could participate. The email advised that the pilot of MOX had been in the display three years previous and had ‘done this very sequence’, described as being ‘fly by + touch and go on water’.
• On the evening of 23 January, the DC submitted a revised float plane display sequence showing details solely for the Caravan. The Instrument (the approval - the term Instrument is discussed in the section CASA approval and oversight of air displays) was sent to the DC at 1940 that evening.
• On the afternoon of 24 January, the DC emailed CASA with documents showing that CQA’s pilot now held the required G-73 type rating and an ‘authority to fly letter’ from CASA. He also requested that CQA now be included in the display. He also submitted the float plane display sequence including the Mallard and the Caravan and a revised program, which now showed CQA and MOX. In his email to CASA, the DC also stated that as a member of the CASA team had reportedly had a concern about the ‘first time [participation of a new pilot and aircraft type]’, he would ‘go along to be of support [to the pilot] for the procedure which should mitigate against that concern’. Revision 2 of the Instrument was issued by CASA that evening.

Risk mitigation

CASA personnel reported that they approved the inclusion of CQA on the basis of having the DC on board, to mitigate against the risk associated with having a new pilot and aircraft type involved in the display. CASA’s documented reason for allowing CQA to participate in the display referred to the email received from the DC on 24 January (detailed above), indicating that he would be on board.

The DC reported that he originally offered to be on board to assist the pilot with any procedural aspects associated with his first time in the display. However, he indicated that having CQA follow MOX for the display effectively mitigated that concern. He also indicated that his offer to be on board CQA was not acknowledged by CASA and there was no indication that this was their expectation. Therefore, he believed his presence on board was not a requirement. Additionally, the pilot elected to depart from Serpentine Airfield, rather than the original Jandakot Airport departure point. As the DC was a participant in five displays that day, he would not have had the time to travel to Serpentine in order to be on board.

As part of their post-occurrence regulatory safety review (see the section titled CASA approval and oversight of air displays section) of the lead-up and conduct of the air display, CASA identified that despite their expectation that the DC would be on board CQA, they had not specifically advised the DC of this, nor was this requirement included in the Instrument of approval. CASA also did not advise the pilot of CQA that the DC being on board was a requirement for his inclusion.

Pre-display briefing and flight planning

The CASA air display guidance manual (see the section titled CASA approval process for air displays) detailed that a written brief of the flying program should be circulated in advance of the air display, to pilots and those in other critical roles. In addition, ‘a formal verbal briefing should be given on the day of the display and at any rehearsal, and all participants, where possible, must attend’. Those not able to attend were to be verbally briefed separately. The manual listed the minimum items that were to be covered in the briefing.

The Skyworks pre-display briefing was held at Jandakot Airport the night before the event. All air display participants were required to sign Form 695 Participant signature sheet, acknowledging that they have read the CASA approval for the air display and would operate their aircraft in accordance with the terms of the approval. The briefing was conducted by the DC in a large cafeteria-style room, with participants seated at various small tables. The Ringmaster and CASA also addressed the participants. The event was video recorded by the City of Perth and the footage^[20] was reviewed by the ATSB. Participants were seen reviewing copies of the written brief, which had been provided to them at the commencement of the briefing.

The briefing included a discussion of the display area, air space, radio communications and standard approach, holding and departure procedures. As detailed previously, the extent of the float plane-specific brief was, ‘the float planes… will be doing their touch and go…but they won’t be landing fully. If anything they [are] just kissing the water and then do an orbit and then another one and then [depart]’. The DC also discussed the importance of aircraft serviceability, the anticipated weather conditions, considerations about personal fatigue and to ‘have your own risk management’. He also emphasised that they were the lead-up to the main event and there was ‘no pressure to do anything special’, ‘just do everything as you normally do, don’t do anything different’ and to ‘have your own limitations’. The DC reported that separate ‘formation’ briefs were conducted for participating pilots on the morning of the air display, prior to departure from Jandakot Airport.

The pilot of CQA attended the briefing, where he first met the pilot and observer of MOX. The pilot of MOX reported that:

• he and the pilot of CQA discussed airspeeds, who would lead and who would be on board CQA
• it was arranged that the two aircraft would meet at Jandakot Airport (where CQA could refuel and/or collect the DC) or overhead Cockburn Sound (if CQA flew directly from Serpentine Airfield)
• MOX would be the lead aircraft, handle the radio calls and general procedures, so that CQA could follow.

The pilot of MOX reported that he did not have any expectations of CQA’s pilot, other than CQA would follow MOX. He recalled that the pilot of CQA had suggested he would not touch the water, but conduct a low overshoot. On the day of the display, the pilot of MOX received a text message from the pilot of CQA at about 1515, advising he would meet MOX overhead Cockburn Sound.

Carriage of passengers during the air display

Civil Aviation Regulation (CAR) 2 Interpretation defines a ‘crew member’ as a person assigned by an operator for duty on an aircraft during flight time and ‘operating crew’ as any person who:

• is on board an aircraft with the consent of the operator of the aircraft; and

• has duties in relation to the flying or safety of the aircraft.

CASR Dictionary – Part 1 – Definitions describe the following roles:

Flight crew member means a crew member who is a pilot or flight engineer assigned to carry out duties essential to the operation of an aircraft during flight time.

Passenger, in relation to an aircraft, means a person:

(a) who:

(i) intends to travel on a particular flight on the aircraft; or

(ii) is on board the aircraft for a flight; or

(iii) has disembarked from the aircraft following a flight; and

(b) who is not a member of the crew of the aircraft for the flight.

Under Civil Aviation Order 29.4 Air Displays, one of the conditions of approval to conduct an air display is that ‘passengers shall not be carried for hire or reward during any part of the air display except where specifically approved as part of the program’. While this did not exclude the carriage of passengers for no compensation, the CASA instrument of approval for the 2017 Skyworks air display was more explicit, stating that ‘passengers shall not be carried in display aircraft and only aircrew essential to the operation of the aircraft are to be carried’. Similarly, the following statements were included in the Flight Crew section of the air display manual:

No persons other than operating crew may be on board a civil aircraft during the air display unless the prior written permission from CASA has been obtained.

The responsibility for ensuring that an aircraft is operated in accordance with its Certificate of Airworthiness, Permit to Fly and Air Display Approval rests with the pilot in command. This does not absolve the Display Organiser from the responsibility to take such action as is necessary should a display aircraft deviate from the bounds of any approval or operate in an unsafe manner.

In addition to the regulatory considerations above, as part of the pre-display briefing the DC reinforced that ‘you’re not allowed to carry passengers but you are allowed to carry operational crews’.

During discussions following the pre‑display briefing conducted on 25 January 2017, the DC was made aware that the pilot of CQA intended to have an additional person on board, in the right front seat. The pilot had mentioned to several people that it was necessary for this person to be on board CQA to assist in the case of needing to manually deploy the main landing gear. The Mallard’s flight manual did not include this method for releasing the main gear and other Mallard pilots reported being unaware of it.

This reasoning was also raised by the pilot when questioned by CASA officers after they witnessed two people disembark the aircraft during CQA’s participation at the Great Eastern Fly-In events at Evans Head Aerodrome, New South Wales on 7‑8 January 2017. The outcome of that conversation was that the CASA officers informed the pilot that his passenger did not meet the definition of essential crew.

The CASA officers that participated in the discussion at Evans Head were from the sport aviation office and were not aware of the pilot’s application to participate in the Perth Air Display. The Perth office was similarly unaware of the discussion that had taken place at the Evans Head event when they assessed the pilot’s application for the Perth display.

The pilot’s logbook indicated that his passenger had flown on CQA several times, between 6‑13 January 2017 and had a total time on board CQA of about 19 hours. While it was reported that the passenger was interested in flying training, information received from CASA and the National Transportation Safety Committee (NTSC), Indonesia found that she had not registered with either organisation and did not hold a flight crew licence.

It was also reported that the pilot had invited another person to be on board during the Skyworks display. However, the pilot’s decision to minimise the weight of the aircraft due to the temperature on the day, prior to departure from Serpentine Airfield, resulted in that person not being on the accident flight.

Following a recommendation from their regulatory safety review conducted after this accident, CASA published a revised Form 697 Pilot or essential crew details in April 2018. This expanded form added a checklist of considerations for display pilots in relation to their intended display. Sections were also included to allow for identification and reasons for the requirement of additional crew and a DC checklist to ensure consistency in the application. In addition, this form was now required to be signed by the pilot, crew (if applicable) and the DC.

Air display roles and responsibilities

Documented roles and responsibilities

CASA’s Air Display: Safety and Administrative Arrangements manual (air display manual) provided guidance on the minimum safety and administrative procedures necessary to run an air display. The manual included a list of key personnel and their responsibilities, most notably, that of the Display Organiser, Display Coordinator and flight crew (Table 1).

Table 1: CASA Air Display Administration and Procedure Manual ^[21] terminology of air display roles

The CASA-issued instrument granting approval for the 2017 air display assigned the City of Perth to the role of ‘Display Operator’ and separate individuals to the roles of DC and Ringmaster. The instrument did not assign a DO.

The role of Display Operator was not defined in the air display manual, however they, along with the DC, had a responsibility via the instrument to ensure that the display was conducted in accordance with the relevant legislation.

Recognising the discrepancy between the roles defined in the air display manual and the instrument, the role titles identified in the CASA‑issued Perth air display instrument are used throughout this report for consistency.

Display Coordinator

During the 2017 display organisation and approval, the DC carried out some of the responsibilities of that role, as well as that of the DO, per the air display manual. When interviewed by the ATSB, members of the CASA team referred to the same individual as both the DO and DC. It was noted that this was possible in accordance with the manual.

The DC held an Air Transport Pilot (Aeroplane) Licence and a Commercial Pilot (Helicopter) Licence, for single- and multi-engine aeroplanes and single‑engine helicopters. He held multiple design feature endorsements including floating hull and float plane. The DC was endorsed for aerobatic flight activities and held low-level ratings for both aeroplanes and helicopters.

The DC had been involved as a pilot in the Perth Air Display since its inception and over time voluntarily took on various roles with respect to planning, procedures and approvals. He was directly involved in developing the display program and conducting the pre-flight brief, typically the night before the event. He advised that on the day of 26 January each year, ‘I’m just a display pilot… just like all the other pilots participating in the displays’. The DC advised that responsibility for ensuring the display instrument was being followed on the day of the event was with the Ringmaster.

The DC self-identified as the ‘air display liaison’ which was also reflected on the Airservices Australia letter of agreement (airspace arrangement) and the City of Perth Skyworks emergency contact list. Despite this, the DC had entered his name as DO on the 2015, 2016 and 2017 application forms.

With regard to the approval process, the DC reported that different CASA officers had different application requirements. He indicated his role was to provide information to CASA, to allow them to assess and approve the display. The DC said that CASA had requested to observe a certain routine in the past, before issuing the display approval. It was therefore the DC’s opinion that it was ultimately CASA’s decision as to whether or not to approve a pilot and their display.

In contrast, several CASA officers reported it was the DO/DC’s responsibility to ensure that a pilot and/or display was suitable, before including them in the application. However, CASA officers also stated that it was ultimately the individual pilot’s responsibility to satisfy themselves that they were capable of conducting the intended display.

The DC reported that he did not necessarily have the opportunity to know each pilot and their display, however he would not invite a pilot that he felt was not suitable to be part of the display. The DC noted that some years certain pilots and/or aircraft were not available but on the whole the applications were similar each year, with just an occasional display name change. Other than inviting the participation of the Mallard, the DC could not recall the last time a new display was introduced.

Ringmaster

The Ringmaster carried out a portion of the DC’s responsibilities as they related to controlling the flying program on the day.

The Ringmaster held a Commercial Pilot (Aeroplane) Licence and was a flight instructor. She reported having been involved in the event for about nine years, first as an observer with the DC in a Caravan, then assisting the previous Ringmaster during one display, before taking on that role. The Ringmaster described her role as coordination of the display aircraft and monitoring them for good separation. She advised she would sometimes offer or approve a request for additional fly-bys where time permitted. The Ringmaster also coordinated the various banner/flag aircraft between displays.

For the 2017 display, the Ringmaster was located in a room on the twelfth floor of a hotel, situated on the northern side of Langley Park that provided a full view of the display area (Figure 11). An assistant located with the Ringmaster provided support in visually monitoring aircraft movements when the Ringmaster was conducting radio communications. The assistant advised he was a flight instructor and had been in that role for the last four or five years.

When the approval for CQA’s third pass was granted by the Ringmaster, the assistant reported that their vantage point and the position of the sun made it difficult to identify exactly what the aircraft was doing over Melville Water (Figure 11) prior to returning to the display area. Although the Ringmaster did not specify the manner in which the Mallard was to return for the third pass, the assistant expected the approach to be via the standard procedure, behind the city, and was surprised when he realised CQA was re-entering Perth Water directly. He reported that CQA may have flown over boats^[22] lower than the authorised height, but as the moment had passed, there was no gain in immediately contacting the pilot about it. The Ringmaster advised that she did not observe CQA until just prior to the accident as she was communicating with a banner‑towing helicopter via radio.

Figure 11: The view of Langley Park from the Ringmaster’s vantage point

Source: City of Perth

The Ringmaster had a copy of the Instrument, emergency contact list and display schedule with her on the day. The display schedule contained basic detail of the actual display routines, however it was reported they were generally similar each year. Further, she did not necessarily know who was on board each aircraft, other than the schedule‑listed pilot. The Ringmaster generally didn’t communicate with pilots during their display, so as not to distract them, but would make a call if there was something unsafe.

Suitability assessment for key roles

The CASA air display manual in effect at the time of the occurrence made limited reference to the suitability or experience required for individuals to hold key roles. The guidance was that the DO should have considerable aviation experience if also assuming the function of the DC, or otherwise appoint a suitably qualified person, preferably with display experience. There was no mechanism detailed for assessing the suitability of individuals for the roles and no additional training or accreditation.

By contrast, the Civil Aviation Authority United Kingdom (CAA UK) published Civil Aviation Publication (CAP) 403 Flying Display and Special Events: A Guide to Safety and Administrative Arrangements. CAP 403 provided detailed information about the roles and responsibilities of event organisers and participants. From 1 May 2017, the UK CAA implemented Flying Display Director (FDD)^[23] accreditation. The accreditation scheme required the applicant to ‘demonstrate their knowledge, experience and capability against a number of FDD competencies’ including:

• regulatory compliance
• maintaining flying discipline
• risk management
• ‘understanding of human factor influence on the safety of flying displays’.

The applicant was also required to undergo behavioural and attitudinal fitness assessments.

If successful, the FDD would be authorised to an appropriate tier level, based on degree of display complexity, for a period of three years and must maintain currency for re-accreditation. The United States and New Zealand had similar programs to ensure the knowledge and suitability of the person primarily responsible for coordinating the event.

The CAA UK also required formal evaluation of potential display pilots and their intended routine. This involved having an authorised Display Authorisation Evaluator (DAE) evaluate and mentor a pilot, at which point the pilot can apply for a Display Approval (DA), which was required to participate in a CAA UK authorised event.

Similar to the FDD, to be granted a DA a pilot was required to undergo behavioural and attitudinal assessment to determine their suitability for a flying display role. The pilot’s DA was aircraft type and routine-specific. These accreditation requirements were established in the mid-1980s, with additional restrictions and formalised training introduced after the 2015 Shoreham Air Show accident (see the section titled Related occurrences). As with the FDD role, currency and re‑evaluation was required for re‑validation of the DA. At the time of writing, the United States had a similar pilot evaluation program for aerobatic pilots.

Additional guidance was provided by the CAA UK publication, CAP 1047 Civil Air Displays – A guide for pilots. This publication was ‘intended to provide advice to display pilots to help them avoid the pitfalls which have been experienced in the past’. Topics included personal fitness, planning and practicing for displays, and what to do on display day.

CASA approval and oversight of air displays

Regulations and guidance material

Australia’s Civil Aviation Act 1988, through the Civil Aviation Regulations (CARs) and Civil Aviation Orders (CAOs), provides CASA with the authority to regulate exhibitions of flying, commonly referred to as air displays, flying displays or airshows involving civil aircraft.

CAR 156 and CAO 29.4 cover the regulatory requirements as they relate to air displays. CAR 156 relates to flying over public gatherings. CAO 29.4 outlines the application process and specifies the conditions of approval, planning and control requirements. The order states that an air display shall not be conducted without the written approval of CASA and that the organiser shall be responsible for ensuring that the applicable regulations are met.

CASA also developed the Air Display: Safety and Administrative Arrangements (air display manual) as guidance material to be read in conjunction with the regulations.

Air Display Manual

The air display manual provided guidance on the minimum safety and administrative procedures necessary to run an air display. It outlined the responsibilities of key personnel involved in an air display, including that of the DO, DC and display pilot (flight crew) (see the section titled Air display roles and responsibilities). The guidance in effect at the time of the display approval process was version 1.3 (November 2010). While the air display manual contained detail with respect to responsibilities of the DOs, it was limited in guidance with respect to assessing an application to an expected standard.

In comparison with other jurisdictions, the United States FAA order 8900.1 Volume 3, Chapter 6, Section 1 contained detailed guidance around processing and assessing applications for aviation events (including air displays) to determine whether to issue a certificate of waiver or authorisation to an applicant.

At the time of the occurrence, a revised air display manual had been drafted. Subsequently, version 2.0, significantly revised and renamed the Air Display Administration and Procedure Manual, was published in September 2017, with version 3.0 published in April 2018.

Receipt and processing of air display applications

Applications to conduct air displays were generally submitted to the local regional CASA office, using Form 696 Application for approval to conduct an air display, along with supporting documentation. After assessment of the application, the officers provided advice in the form of a ‘reason for decision’ to the authorised CASA delegate. If approved, the delegate then issued an Instrument under CAO 29.4, identifying the person, or organisation, authorised to conduct the air display. This Instrument formed the approval and permission to conduct the air display, including any CASA‑imposed conditions.

As part of this investigation, the ATSB reviewed Skyworks display approvals conducted by the Western Region (Perth) office, as well as those for the Great Eastern Fly-In conducted by the sport aviation office between 2015‑2017.

Staff in both the Perth and sport aviation offices developed forms or checklists to assist the display approval process. The Perth office developed an ‘Air Display Energy Management’ form, which was used in the 2015‑2017 air display documentation to provide detail for some aerobatic and specialised displays. The form was titled ‘CASA Western Region – Air Display Form’ and had provision for ‘participant’ and ‘DC’ signatures. However, none of the ‘Energy Management’ forms reviewed had been endorsed by the DC.

The sport aviation office developed a spreadsheet to monitor air display pilots’ medicals, licence and endorsements, and aircraft registrations and airworthiness categories. This office also developed a risk assessment document for DOs to complete and submit with their application, and a checklist to monitor the progress and requirements of the approval process. It was reported these additional measures were implemented to ensure consistency and standardisation of the sport aviation office approval process.

The region-specific documents were not referenced in the air display manual nor disseminated more widely. Additionally, the Perth and sport aviation offices were also unaware of the documentation each other had developed.

Air display surveillance

The CASA Western region office increased their involvement in the 2017 air display in response to a drone sighting in Perth Water and a near-collision involving display aircraft, just outside Area Alpha, during the 2016 event.

The office initiated a surveillance activity, which included ramp checks ^[24] at Jandakot Airport before the air display, and observations of the City of Perth and Police coordination centre and Ringmaster locations. CASA advised the DC of these planned activities in early January 2017 and subsequently met to discuss the purpose of the activities and to address concerns of the DC that the surveillance activity may distract the involved pilots.

After CASA staff escalated the DC’s concern internally, the decision was made to continue with the planned surveillance activities as there had not been any formal surveillance of the event for a significant time period, and the staff understood that the upcoming version of the air display manual would require such activity in the future.^[25]

CASA officers attended Jandakot Airport on 26 January 2017, from 1330 until about 1630. The surveillance included a series of ramp checks, observation of formation briefs and general liaison with participants. Due to the proximity of the ramp checks to the display, there was reported concern among the DC, Ringmaster and some of the air display pilots that the checks may have caused stress or distracted pilots immediately prior to flying.

It was reported to the ATSB that the pilot of CQA elected to depart from Serpentine Airfield (instead of Jandakot Airport) to avoid the surveillance activity. While that could not be verified, departure from Serpentine meant there was no opportunity for either CASA, the DC or the pilot of MOX to observe or engage with the pilot prior to the display.

While the Perth office reported they generally attended the pre-display briefings, they did not have a policy to observe, and did not routinely attend the air display. By contrast, the CASA sport aviation office regularly attended the air displays they approved. They reported that this allowed them to observe that the requirements of the display authorisation were being upheld and provided assurance that the documented Instrument was relevant. In addition, the sport aviation office reported that regular attendance of air displays fostered good cooperation with organisers and participants.

Air display risk management and governing framework

Defining risk management

International Standard ISO 31000:2018 Risk management – Guidelines defines risk as the ‘effect of uncertainty on objectives’. That is, deviation from the expected. Risk management is defined as ‘coordinated activities to direct and control and organization with regard to risk’. Some of the key risk management principles include that it:

• be integrated into organisational (or in this case, event-based) activities
• provide a structured and comprehensive approach, allowing consistent and comparable results
• be dynamic, as risks can emerge or change as the context changes
• use the best available information, so that both historical and current information from all stakeholders can inform the risks.

The risk management process in ISO 31000:2018 is outlined in Figure 12, and defined as involving:

…the systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing and reporting risk.

This process is designed to be an ‘integral part of management and decision making’ and can be applied at any level including operational matters.

Figure 12: The risk management process

Source: International Standard ISO 31000:2018 Risk Management - Guidelines

The elements of this risk management process relevant to air display preparation, included:

• Communication and consultation: where relevant expertise is brought together to ensure the right information is considered when identifying, assessing and controlling risk. In this case, the input of stakeholders such as the City of Perth, DC, Ringmaster, CASA and the display pilots.
• Scope: In the context of an air display, the scope should include all activities that may affect the safety of the flying operations.
• Risk identification: the purpose of risk identification is to ‘find, recognise and describe risks that might help or prevent’ the desired outcome. In this context, it is important that regulators and DOs consider potential threats, indicators of emerging risks (for example, late inclusion of a new display), limitations of knowledge and time-related factors.
• Risk treatment: the purpose is to ‘select and implement options for addressing risk’, including whether a certain risk is to be avoided, changed, shared or retained. Relying on individual pilots to manage their own risks when taking part in an air display is a limited treatment strategy, but combined with more systematic approaches and the collective knowledge of others allows for improved identification of defences.

There is further guidance about the risk management process in ISO 31000:2018 and the September 2017 CASA air display manual.

The concept of a risk framework

As outlined in ISO 31000:2018, a framework for managing risk is designed to ‘assist [organisations] in integrating risk management into significant activities and functions’ for good governance. ‘Framework development encompasses integrating, designing, implementing, evaluating and improving risk management’ across an organisation or group of people.

The United Kingdom (UK) Department for Transport commissioned a study in response to a recommendation from the UK Air Accident Investigation Branch investigation of the 2015 Shoreham accident (see the section titled Related occurrences). The resulting report, A Review of UK civil flying display and special event governance, discussed the concept of governance and how it can range from structured to informal in nature. A governance framework was described as providing ‘an organisation or a group of individuals with common objectives, and reflects the interrelated relationships, factors and other influences on them’. The report stated that good governance should:

• provide a set of processes and procedures to deliver clear direction and oversight to industry
• distil down specific roles, accountabilities and communications, and
• provide a feedback loop that can identify trends and respond to changing circumstances, challenges and regulatory needs.

A visual representation of such a framework, based on good governance principles, was developed to review the UK civil aviation flying display activities, existing around the time of the Shoreham accident. It depicted interactions between the government, the CAA UK and industry (Figure 13). It defined the governance infrastructure as the ‘people, processes and systems to manage day to day activity and reporting’. The top half of the diagram shows those activities that the CAA UK have primary responsibility for defining, developing and participating in, including:

• performance – including monitoring of safety performance indicators, and conducting audits
• strategy – including reviewing and updating legislation
• organisation – including defining the roles of those organising the air display, accrediting the display organisers and briefing display pilots
• talent – including developing CAA UK staff skills, mentoring display pilots and shadowing display organisers

The bottom half outlined the areas to be delivered by industry, where the CAA’s responsibilities were more related to understanding, oversight and monitoring (rather than active involvement). This included the planning of the display, the operations themselves, and compliance with regulations.

Throughout this, the CAA UK is also responsible for establishing a risk management framework, including the application of a risk assessment process, auditing flying displays, and setting a risk matrix applicable for flying displays.

Figure 13: United Kingdom civil flying display governance framework

Source: Helios, 2018

Risk management for air displays

In April 2016, CASA convened a working group to update the air display manual. That group identified that the risk assessment process was likely an appropriate and effective tool for the assessment of air display approvals. Despite that, the air display manual in effect for the 2017 air display did not include a requirement to complete a risk assessment as part of the planning or approval processes. However, the September 2017 version of the Manual included a requirement for the DO to ‘compile and conduct [a] risk assessment’, and provided comprehensive guidance in an appendix.

As previously mentioned, the CASA sport aviation office advised that they expected DOs to include a risk assessment as part of their application. An example reviewed by the ATSB for the Great Eastern Fly-In included risks associated with a range of operational activities, including flight and group operations, maintenance, display pilot matters and airspace.

In reviewing other States’ requirements for their air displays, the ATSB noted that the Civil Aviation Authority of New Zealand (CAA NZ) included in their Advisory Circular AC‑91‑1 Aviation Events that the organiser was expected to risk assess the activity. They add that:

The responsibility of implementing and monitoring risk removal and risk mitigation steps falls to the organiser, flying display director and flying display committee. They should therefore all be involved in the risk assessment of the aviation event.

Similarly, the CAA UK CAP403 Flying Display and Special Events: Safety and Administrative Requirements and Guidance outlined that ‘risk assessment is an essential element in the production of any safety plan…Flying Display applicants are required to submit information about any risks that will be actively managed during the event to CAA as part of the display application process’.

Skyworks risk management activities

The City of Perth developed a risk management plan, covering activities associated with the events and coordination around Skyworks, including the air display. It outlined key responsibilities for stakeholders and the tools that were used to identify, assess and control risk. One of these tools was a risk register, which included a number of aviation-related risks such as ‘aircraft/skydive incident causing injury or ill health’. The mitigation for that risk included the provision of the air display approval, and proposed surveillance, from CASA, a landing area exclusion zone and an emergency response plan. The DC provided input into this risk management plan or risk register. Risks identified from previous years’ events included the effects of falling debris, an ‘aircraft incident on Perth Water’, particularly among the moored boats, and skydivers landing in unintended areas.

A near‑collision occurred during the 2016 air display involving a banner tow aircraft and a group of display aircraft, just outside of Area ALPHA. The occurrence prompted the DC, in late January 2016, to request that CASA assist with a modification to area ALPHA for the 2017 display, to reduce the risk of a repeat occurrence. In conjunction with Airservices Australia, CASA’s Office of Airspace Regulation requested that the DC complete a risk assessment, relating to the proposed airspace changes for the 2017 display. The DC questioned the need for the risk assessment when it had not been required previously. In addition, the DC advised CASA he would sign a risk assessment that CASA prepared, when he returned from an overseas trip in November 2016. In response, CASA encouraged him to develop it as a ‘living document’ rather than rely on his experience in the conduct of the air display and examples of risks were provided to the DC. A completed risk assessment (limited to the scope of airspace changes) was ultimately supplied to CASA and the airspace changes were authorised.

In the lead-up to the air display, the CASA Perth office liaised with the DC on some concerns such as the draught of the Mallard in the water and the single‑engine performance. However, apart from the requested risk assessment relating to airspace matters, there was no formal or systematic way that other types of operational risks were identified, assessed and controlled. There was also no requirement to do so under the current regulations.

Related occurrences

Within limitations of the ATSB occurrence database, there were approximately 22 air display‑related occurrences in the ATSB database between 1969 and 2017. Thirteen of those occurrences resulted in a fatality, therefore averaging one fatal accident every 3.7 years. The majority of the occurrences were related to aircraft handling, resulting in loss of control and collision with terrain.

The ATSB also reviewed other states’ investigations into air display accidents, particularly those involving passengers and/or spectators. The scope of the review was to gain appreciation of risk factors to spectators, and where lessons learned had resulted in improvements to the planning and approval of air displays. A number of occurrences were identified and two of these are discussed below.

United Kingdom

The Air Accidents Investigation Branch, United Kingdom investigated the accident involving Hawker Hunter T7, registration G-BXFI near Shoreham Airport on 22 August 2015. The aircraft crashed on to the Shoreham Bypass while performing at the Shoreham Airshow, fatally injuring 11 road users and bystanders. A further 13 people, including the pilot, sustained other injuries.

Beyond examining the actions of the pilot, the investigation found that:

…the parties involved in the planning, conduct and regulatory oversight of the air display did not have formal safety management systems in place to identify and manage the hazards and risks. There was a lack of clarity about who owned which risk and who was responsible for the safety of the air display, the aircraft, and the public outside the display site who were not under the control of the show organisers.

The regulator believed the organisers of air displays owned the risk. Conversely, the organiser believed that the regulator would not have issued an approval for the display if it had not been satisfied with the safety of the event…and the display organiser believed that it was the responsibility of the operator or the pilot to fly the aircraft's display in a manner appropriate to the constraints of the display site.

No organisation or individual considered all the hazards associated with the aircraft’s display, what could go wrong, who might be affected and what could be done to mitigate the risks to a level that was both tolerable and as low as reasonably practicable.

Controls intended to protect the public from the hazards of displaying aircraft were ineffective.

Additional detail in the report included consideration of risk to spectators outside the event, non‑participants (general public in the area) and proximity of residential, industrial and recreational areas, including schools and hospitals.

United States

On 16 September 2011, an experimental single-seat North American P-51D collided with terrain while participating the National Championship Air Races in Reno, Nevada. The pilot and 10 people on the ground sustained fatal injuries and at least 64 others were injured. The National Transportation Safety Board (NTSB) investigation identified the aircraft was conducting a turn just prior to the loss of control. The NTSB made several recommendations, including evaluation of the course design and safety areas to minimise manoeuvring near, and potential conflicts with, spectators. The event organiser subsequently relocated the course and primary spectator area to ‘create and maintain a greater distance’ between the racers and spectators.

__________

6. The training was conducted over two trips to the United States, each consisting of three days, in March and May 2012.
7. A dirty pass involves the aircraft being configured for landing with flaps and landing gear extended.
8. A seaplane is a fixed wing aircraft that can operate from the water and is identified by two categories: floatplanes, having pontoons or floats as landing gear, and flying boats, where the main source of buoyancy is the fuselage. Amphibian aircraft are capable of routinely operating from land or water. All three terms are often interchanged.
9. The Mallard has a constant angle of incidence (or zero-washout) wing with an identical profile from inboard to outboard. The term washout refers to where a wing is designed with a reducing angle of incidence towards the wing tip, which usually results in a stall progressing from the wing root to the tip, providing increased aileron control during a stall onset and some resistance to spinning. It also provides a softer stall onset and increasing aileron authority during the early stages of a stall.
10. CASA identify some G-73 variants as requiring multi-crew (two pilots) for operations.
11. A stall warning device can give the pilot a warning of an impending stall, which can include aural (horn) or visual (light or angle of attack indicator) signals.
12. The Bureau of Meteorology records weather observations from Perth Airport (10 km from Perth Water), Melville Water (4 km away) and Mt Lawley (4 km away). Data from these locations was analysed to provide conditions most likely experienced within Perth Water.
13. A Temporary Danger Area is an airspace established for a specified period and of defined dimensions within or over which activities of potential danger to aircraft flying over that area may exist.
14. Operations above 1,500 ft AMSL in Area ALPHA, such as aerobatic displays, required ATC clearance to operate in class C airspace.
15. The Cessna 206 is a six-seat aircraft with a maximum take-off weight of about 1,600 kg and the Buccaneer is a fourseat, light amphibious aircraft with a maximum take-off weight of about 1,220 kg. The Cessna 208 aircraft is described in the section titled VH-MOX and flight crew information.
16. Refer to the section titled Air display roles and responsibilities
17. On the step is when the attitude of the aircraft on the water is nearly level and the weight of the seaplane is supported mostly by hydrodynamic lift (the upward force produced by the motion of the floats through the water). The rear section of the float, aft of the step, is clear of the water, which greatly reduces drag during take-off. This is also known as fast taxi.
18. There was no float plane involvement in 2016.
19. The other float plane was later withdrawn from the display due to unavailability.
20. The footage was taken from several angles and contained some gaps in the briefing. It did, however, provide an overall appreciation of the conduct and content of the briefing.
21. CASA procedures and manuals detailed in the section CASA approval and oversight of air displays
22. Flight over moored vessels at this location would also involve flight over the built-up area of the South Perth peninsula.
23. The Flying Display Director’s responsibilities most closely aligned with those of the Display Coordinator in CASA’s Air Display: Safety and Administrative Arrangements manual
24. CASA advise that ramp checks are conducted to make sure flight operations are being carried out safely and in accordance with regulations. A typical ramp check involves the inspection of documentation, flight preparation (including the aircraft).
25. The Air Display Administration and Procedure Manual published September 2017 included the following statement: The scale of CASA attendance at the event, if any, will depend on the nature of the event, scale and location of the display.

Safety analysis

Following two low fly-bys along the Langley Park foreshore as part of the City of Perth Australia Day Skyworks event, the pilot of Mallard VH‑CQA (CQA) manoeuvred his aircraft in order to conduct a third pass. During the final positioning turn, CQA rolled left, pitched nose‑down and collided with water. The pilot and passenger were fatally injured, and the aircraft was destroyed. This analysis will examine the:

• loss of control
• pilot’s actions in returning to the display area for a third pass
• carriage of a passenger
• regulatory framework for approval and oversight of air displays.

As part of the analysis, comparisons have been drawn with other country’s regulations, guidance and practices as a means of benchmarking other methods for managing air displays. Other countries have also published extensive guidance material and some have dedicated air display organisations to support those organising and participating in air displays.

Loss of control

Analysis of recorded flight and video data, and witness reports identified that the aircraft stalled in the positioning turn for the third pass. Such a loss of control in this aircraft type at the relatively low operating altitude meant the situation was unrecoverable before contact with the shallow water.

Technical examination of the aircraft did not identify anything that contributed to the accident. In the absence of a problem with the aircraft, the stall most likely resulted from a handling error and there were several factors that increased the risk of that occurring.

The pilot had limited recent experience operating the Mallard and had not previously participated in a display involving low-level turns within a confined area. Considering this, and noting the limited opportunity available due to his late inclusion and licencing issue, the pilot had not practiced for the event.

The pilot’s lack of familiarity was intended to be mitigated by following another participating aircraft, VH‑MOX (MOX), during the display sequence and having a pilot familiar with the display present in CQA. These defences were not effective however, as CQA parted company from MOX prior to returning to the display area in a different manner to that associated with the first two passes and there was no accompanying pilot on board CQA during the flight.

Additionally, although current and recent in accordance with the regulations, the pilot had not undergone any formal training in the Mallard in the five years since his endorsement and had satisfied the intervening biennial flight review requirement in a different aircraft type. This was despite the Mallard being a type-rated aircraft, considered as having performance or handling techniques that warranted specific training and flight reviews. The lack of assessment in the Mallard since endorsement was a missed opportunity to objectively confirm the pilot’s competency, or identify and correct any degraded skills specific to operation of that aircraft.

Finally, although not a requirement, the aircraft was not fitted with a stall warning device that may have alerted the pilot to the developing situation in sufficient time to take corrective action.

There was insufficient evidence to establish the extent to which any of these factors influenced the development of the accident. Similarly, the degree to which a focus on participating in the event may have distracted the pilot from operating the aircraft could not be determined.

Returning for the third pass

The pilot of MOX only conducted the two planned passes and was unaware of the intention for a third by CQA until it was requested of the Ringmaster. This impromptu action was contrary to the briefed plan that the two aircraft would fly in company to mitigate against potential issues with the pilot of CQA’s unfamiliarity with the display.

After completing the second display pass, MOX departed the display area bound for a return to Jandakot Airport, followed by CQA. By the time CQA turned to return for the third pass, it was well inside Melville Water. On approving the third pass, the Ringmaster did not offer any direction regarding its conduct and the pilot elected to track directly back to Perth Water. The return to the display area was conducted at low altitude over the built-up area of The Narrows and moored watercraft, which was a deviation from the display approval.

Although not observed by the Ringmaster, the assistant assessed that CQA may have passed over boats below the authorised height during the return for a third pass. However, because CQA had then effectively joined the downwind leg of the accepted orbits over Perth Water, no immediate action was considered necessary.

Left orbits in the Mallard within the confines of Perth water were possible while adhering to the display conditions. However, the requirement to remain clear of the spectators, including watercraft, meant that the area was relatively confined. As a result, manoeuvring within the display area, as opposed to entering it in the prescribed manner around the city, required turns at higher bank angles and lower altitudes, which reduced the margin for error. Had CQA re-entered the display area using the standard procedure, the manoeuvres required to position for the pass would have been relatively benign and significantly reduced the risk of mishandling the aircraft.

Pilot decision making

Nature of decision-based errors and motivational factors

In considering whether the pilot’s actions in returning for the third pass were reasonable to him at the time, it is useful to consider the nature of decision-based human error. One such example, knowledge-based mistakes, are defined as ‘errors brought about by a faulty plan or intention’. They arise in novel situations with ‘resource limitation (bounded rationality) and incomplete or incorrect knowledge’ (Reason, 1990) and likely arise from a lack of appreciation of potential consequences (Harris, 2011). Knowledge-based mistakes can be significantly influenced by certain ‘performance shaping factors’ (O’Hare, 2006). These can be external factors, such as environmental conditions, equipment design and procedures, or internal factors, such as a pilots’ emotional state, physical condition, stress, experience, and task knowledge.

As discussed, the pilot was not well-prepared for the planned display. Additionally, although the pilot attended the pre-display briefing and had access to the display procedures, CQA had likely only ever planned to follow MOX and therefore it is possible that the pilot placed less emphasis on familiarisation with the complete display conditions and procedures. These factors may have contributed to a level of unfamiliarity with the task that resulted in the pilot flying the display with an incomplete or incorrect knowledge and/or appreciation of the potential consequences.

As part of the investigation, the ATSB also considered the motivational effects of being part of event such as an air display. The pilot was reportedly enthusiastic about being involved and was known to enjoy displaying what was a unique and interesting aircraft. While it is difficult to quantify the effect of the pilot’s emotional state in this occurrence, these elements have the potential to influence pilot behaviours, which is reflected by the inclusion of display pilot attitudinal assessments in other jurisdictions.

Handling human factors considerations in air displays: other countries

The human factors considerations of air displays is a topic that has gained more traction in recent years. As part of the Civil Aviation Authority United Kingdom (CAA UK) response to the Shoreham accident findings (one of which required them to undertake a study of error paths that lead to flying display accidents), a workshop called Human Factors in Flying Displays was held in 2017, and attended by about 35 DOs and pilots. One of the topics of discussion was the ‘personal qualities and characteristics of display pilots’ and the DOs. Boundaries between ‘confidence and arrogance’ were discussed, and the importance of promoting learnings and good practices among display pilots.

Additionally, the CAA UK-commissioned study authored by Butler and others (2018) raised some considerations for the future, finding that:

the processes related to the assurance of the competence of air display pilots was a recurring contributory factor highlighted in accident reports. These included training, supervision, practical experience and assessment.

They included a recommendation in their report for display pilots to undertake human factors training, provided by the CAA UK to ‘ensure there is an exchange of expertise across the display community’.

Other States have recognised the need to improve air display pilots’ overall proficiency. For example, the Federal Aviation Administration (FAA), United States, established the Aerobatic Competency Evaluation (ACE) program where pilots must obtain a Statement of Aerobatic Competency (SAC) card prior to conducting aerobatics, or other defined manoeuvres. The FAA delegated the ACE program to the International Council of Air Shows (ICAS), subject matter experts.^[26] ICAS published the Air Show Performers Safety Manual to ‘help establish an understanding of the risk factors attendant to air show performances’.

Summary

While the precise reasons for the pilot’s actions will remain unknown, there were several factors that may have influenced the pilot’s decision making, and which reinforce the importance of planning and practicing for displays. A safety message was highlighted in the CAA UK’s guide for display pilots, which emphasised:

Never be tempted to make unrehearsed changes to your display routine and do not undertake any manoeuvres you have not practiced….Stick to your planned routine but always be prepared, particularly at hot and high displays, for reduced aircraft performance…Never press on into a manoeuvre with less than ideal start conditions.

Carriage of a passenger during the display

Participation in an air display is a specialised aviation activity that frequently involves flying the aircraft in a non‑standard manner and in unique locations. As such, there is an increased risk associated with this type of flying and for this reason passengers are not permitted to take part.

This requirement was clearly stated in the conditions of the display. The pilot had also received the display briefing the night before, reinforcing this condition. Additionally, the pilot had previously been informed by staff from the Civil Aviation Safety Authority (CASA) that the person carried was a passenger and was not considered as crew for the purpose of an air display. Despite this, he carried this passenger during the Perth display, which increased the severity of the accident outcome.

Regulatory framework for approval and oversight

According to the International Standards ISO 31000:2018 Risk management – Guidelines and a review of the UK CAA’s approach towards air displays, good governance in this context comes from activities such as:

• having processes and procedures for the industry and the regulator to work by
• clearly delineating and providing guidance in the roles and responsibilities of organisers and pilots
• monitoring safety performance of those involved in the planning and preparation of the air display including ensuring that regulator staff are adequately prepared.

The regulator’s responsibilities are met by ensuring there are the right ‘people, processes and systems to manage day to day [air display] activities and reporting’ (Helios, 2018).

With respect to air displays in Australia, although certain regulatory processes did exist, CASA did not have an effective framework to consistently approve and oversight air displays. This was predominantly due to the following factors, which increased the likelihood that key safety risks associated with the conduct of the air display would not be adequately managed. It could not be determined whether the regulatory framework in place at the time of the accident contributed to it.

Air display approval guidance

The CASA‑published manual, Air Displays: Safety and Administrative Arrangements (air display manual) to provide ‘guidance on the minimum safety and administrative procedures necessary to run such an event’. However, there was no comprehensive guidance for the assessment of an air display application or oversight of the event, including the expected standard for certain criteria.

While those assessing the applications had shared their methodology and local knowledge within their office, this information was not readily accessible to all offices. As regional offices sought to independently ensure completeness and standardisation of their assessment processes, they developed local procedures, forms and checklists. Variability in assessment and approval practices increases the likelihood of applying an inconsistent process or standard to the task, increasing the risk that key safety aspects may be overlooked.

In contrast, both the FAA and CAA UK published documents that provided their staff with specific guidance and processes for assessing and approving an air display, which in turn provides some assurance of standardisation.

Roles and responsibilities

Air displays require careful management and coordination. The scale and complexity may differ, but any lack of clarity around key roles will affect how well they are managed. The roles of the display organiser (DO) and display coordinator (DC) are vital to the planning and safe operation of each air display. For this display, the roles were not clearly or consistently defined and there were differences in the understanding of who held those roles, exactly what their responsibilities were or the standard those responsibilities were expected to be carried out. This meant that key, safety‑related elements of the air display planning and oversight were more likely to be overlooked.

These points indicated that CASA’s processes were not effective in ensuring that key personnel were fully aware of their responsibilities or that they were suitably equipped to carry them out to the expected standard. By comparison, the CAA UK, FAA and CAA NZ have all established accreditation programs for persons taking on the role of the DO or DC (or equivalent roles). While the accreditation process varies between countries, the concept is similar. In addition to requiring knowledge of the regulations and role responsibilities, the candidates are individually assessed for suitability including behavioural and attitudinal fitness for the role. Essentially, the accreditation program is designed to provide organisers, and in some cases participants, with the knowledge and skills to effectively and safely plan and coordinate and/or participate in an air display. As such, it provides necessary assurance to regulators that the roles will be carried out with consistency and to the expected standard.

Identification and treatment of risk

The risk management process is designed to be an ‘integral part of management and decision making’ (ISO, 2018) for an event such as an air display. If organisers and regulators take the opportunity to systematically identify, assess and treat risks, it is possible to reduce the impact of hazards on the safety of the event. The application of the risk management process will not, in all likelihood, capture every possible risk, but the process can trigger identification and validation of those that are foreseeable, and prioritise their treatment. In particular, it increases the chances that changes, such as the late inclusion of an unfamiliar pilot in the air display, can be considered in terms of the potential introduced risk.

The air display manual current at the time of the accident was the main reference for organisers however, it did not include a requirement for any risk management activities to be done. It was therefore less likely that CASA staff (unless requiring a risk assessment as part of their local procedures) involved in the approval and oversight of air displays were in a position to review organisers’ perceptions of operational risks, or apply systematic methods of risk management.

In this case, CASA identified a number of safety-related risks, such as the pilot not having the appropriate endorsement on the Mallard and the benefit in having the DC on board CQA to mitigate against the pilot’s inexperience. However, these were not identified through any systematic means, and the treatment measures were sometimes not implemented (for example, the DC was not on board CQA for the display), or had other unintended consequences (authorising the pilot’s participation two days out from the display significantly limited his available time to prepare and practice). These examples, plus the absence of any documented processes or any requirements for the staff organising air displays to use systematic risk management methods, reduced the chances that identified risks were going to be treated adequately and controls implemented.

It is noted that CASA has revised the air display manual since this accident to include a requirement for a formal risk assessment to be completed by DOs, which reflects the best-practice approach to identifying and controlling display risks (see the section titled Safety issues and actions). However, using a risk-based approach for the assessment and approval process itself would probably provide additional safety benefit.

__________

26. ICAS information can be accessed via www.airshows.aero

Findings

From the evidence available, the following findings are made regarding the loss of control and collision with water involving the G-73 Mallard aircraft, registered VH-CQA 10 km west‑south‑west of Perth Airport, Western Australia on 26 January 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The pilot returned the aircraft to the display area for a third pass in a manner contrary to the approved inbound procedure and which required the use of increased manoeuvring within a confined area to establish the aircraft on the display path.
• During the final positioning turn for the third pass, the aircraft aerodynamically stalled at an unrecoverable height.
• The pilot's decision to carry a passenger on a flight during the air display was contrary to the Instrument of Approval issued by the Civil Aviation Safety Authority for this air display and increased the severity of the accident consequence.

Other factors that increased risk

• The Civil Aviation Safety Authority (CASA) did not have an effective framework to approve and oversight air displays, predominantly due to the following factors: 
  • While the Air Display Manual provided guidance to organisers conducting an air display, it did not inherently provide the processes and tools needed for CASA to approve and oversee one and no other documented guidance existed.
  • Unlike the accreditation models adopted by some other countries, CASA did not have a systematic approach for assessing the suitability of those responsible for organising, coordinating and participating in air displays.
  • CASA did not have a structured process to ensure that risks were both identified and adequately treated.

The combination of these factors significantly increased the likelihood that safety risks associated with the conduct of the air display were not adequately managed. [Safety issue]

Safety issues and actions

The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Air display approval and oversight

Safety issue number: AO‑2017-013-SI-01

Safety issue description: The Civil Aviation Safety Authority (CASA) did not have an effective framework to approve and oversight air displays, predominantly due to the following factors:

• While the Air Display Manual provided guidance to organisers conducting an air display, it did not inherently provide the processes and tools needed for CASA to approve and oversee one and no other documented guidance existed.
• Unlike the accreditation models adopted by some other countries, CASA did not have a systematic approach for assessing the suitability of those responsible for organising, coordinating and participating in air displays.
• CASA did not have a structured process to ensure that risks were both identified and adequately treated.

The combination of these factors significantly increased the likelihood that safety risks associated with the conduct of the air display were not adequately managed.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority undertake further work to enhance their tools and guidance for air display approval and oversight, and procedures to ensure the suitability of those responsible for organising, coordinating and participating in air displays.

Sources and submissions

The sources of information during the investigation included the:

• Civil Aviation Safety Authority
• Air Accidents Investigation Branch and Civil Aviation Authority, United Kingdom
• National Transport Safety Board and Federal Aviation Administration, United States
• National Transport Safety Committee, Indonesia
• Civil Aviation Authority, New Zealand
• International Council of Airshows
• Perth Air Display organisers, participants and witnesses
• City of Perth
• G-73 and other float plane pilots
• Bureau of Meteorology
• Airservices Australia.

References

AAIB, Aircraft Accident Report AAR 1/2017 – G-BXFI, 22 August 2015, Air Accidents Investigation Branch United Kingdom

ATSB 2009, Avoidable Accidents No.1 Low-level flying, Australian Transport Safety Bureau, Aviation Research and Analysis publication AR-2009-041

Boud and McFarlane, 2018 Review of UK civil flying display and special event governance, Hampshire, United Kingdom

Butler and others, 2018, Human Factors in Air Displays: Transfer of Behaviours and Error Path Study, Health and Safety Laboratory.

CAA NZ, Advisory Circular (AC) 91-1 Aviation Events, Civil Aviation Authority New Zealand

CAA UK, Civil Aviation Publication (CAP) 403 Flying Display and Special Events: A Guide to Safety and Administrative Arrangements, Civil Aviation Authority United Kingdom

CAA UK, Civil Aviation Publication (CAP) 1047 Civil Air Displays – A guide for pilots, Civil Aviation Authority United Kingdom

CASA 2017, Air display administration and procedure manual, Civil Aviation Safety Authority

Harris, 2011, Human Performance on the Flight Deck, Ashgage Publishing Ltd, London, United Kingdom

International Standard ISO 31000:2018 Risk management – guidelines, ISO copyright office, Geneva Switzerland.

NTSB, Accident Brief AAB-12/01, Pilot/Race, The Galloping Ghost North American P-51D, N79111, Reno, Nevada, September 16, 2011, National Transport Safety Board

O’Hare, 2006, Cognitive Functions and Performance Shaping Factors in Aviation Accidents and Incidents, The International Journal of Aviation Psychology, pp.145-156

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, the City of Perth, the display coordinator, the ringmaster, the ringmaster’s assistant, the pilot of VH-MOX, the National Transportation Safety Board, the Federal Aviation Administration, the International Council of Airshows, the Civil Aviation Authority United Kingdom and the Air Accidents Investigation Board.

Submissions were received from Civil Aviation Safety Authority, the City of Perth, the display coordinator, the ringmaster, and the pilot of VH-MOX. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 21 January 2017, at about 0710 Eastern Standard Time (EST), the pilot of an Air Tractor AT‑401B aircraft, registered VH-DDW, was conducting aerial spraying operations at a property about 10 km NW of Mareeba Airport, Queensland. The pilot was the only person on board the aircraft.

Part way through spraying the load of chemical on an avocado plantation, the pilot climbed the aircraft at the end of a spray run, to about 200 ft above ground level. As the aircraft climbed, the engine suddenly made loud banging noises and the pilot estimated that the engine power reduced by about half.

Figure 1: Location of engine failure and accident site

Source: Google earth annotated by ATSB

The pilot levelled the aircraft and checked the fuel mixture and throttle controls but the engine did not respond. The power available continued to decrease as the pilot looked ahead for a suitable field to conduct a forced landing. The pilot selected a cleared area, but as the aircraft lost height, they realised that the aircraft was not going to make it to that field.

The pilot then radioed their loader driver^[1] and advised that they had engine trouble, the aircraft was ‘going down’, and asked them to contact emergency services. The loader driver had heard the abnormal noise the aircraft’s engine was making, and responded immediately to the pilot.

As the aircraft descended, the pilot sighted powerlines ahead and assessed that the aircraft would probably not make it over them. Therefore, the pilot descended to pass under the powerlines. The pilot again spoke to the loader driver briefly on the radio. The aircraft then collided with several lychee trees and a vehicle that was parked in an orchard. The aircraft came to rest upright and was substantially damaged. The pilot sustained a minor injury.

Figure 2: Damage to VH-DDW

Source: Pilot

Operator report

The operator conducted an investigation into the accident and found the following:

The pilot had conducted a daily inspection, including an inspection of all engine cylinders, and found no signs of cracks. The aircraft had operated normally during the first two flights that day.

The aircraft was fitted with a Pratt and Whitney R-1340 radial engine that had 10,491 total hours and 478.1 hours since overhaul. The engine was inspected after the accident by a representative from an aircraft maintenance organisation and they determined that the number seven cylinder had failed (Figure 3). A crack was located around the circumference of the cylinder head, between the two spark plug holes. A recurring inspection of this area (CASA airworthiness directive AD/PW-P/19) was conducted about 91.9 hours prior to the accident at the periodic (100 hourly or 12-month) maintenance inspections.

Figure 3: Engine cracked number seven cylinder

Source: Aircraft operator, modified by the ATSB

Safety analysis

Post-accident inspection

A post-accident inspection revealed a cracked cylinder.

Pre-flight inspection

The aircraft had operated for about 91.9 hours since the periodic (100 hourly or 12-month) maintenance inspections.

The pilot conducted a pre-flight inspection at about 0500 and everything was normal, the oil was full. The aircraft was fitted with a chip detector,^[2] which did not activate at any time. The engine indications indicated normal temperature and pressure immediately prior to the failure.

Weather and performance

The aircraft took off from Mareeba Airport, which is at an elevation of about 1,560 ft above mean sea level (AMSL), and was operating over a property at about 1,900 ft AMSL. The temperature was about 24 °C and there was 79% humidity. The conditions on the day may have reduced the aircraft’s performance. The pilot had substantial experience operating that aircraft in the local area.

The wind was a light westerly at about 2 kt and when the engine lost power the aircraft was tracking to the east, therefore with a light tailwind. This probably did not significantly affect the glide distance or the landing speed of the aircraft.

Forced landing sites

The area has orchards, houses and powerlines in most of the paddocks with uneven ground and creeks running through it, therefore there were limited sites suitable to conduct a forced landing. The pilot assessed that there was also no suitable road within gliding distance. The accident site was about 2.5 km from where the engine failed.

Chemical load

About 750 L of chemical was still on board the aircraft when the engine lost power. The pilot did not dump the load. The pilot commented that it was an oversight rather than a conscious decision not to dump the load. However, they further commented that they were trained to dump the load in the event of engine failure, and would do that in future if faced with a similar situation.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The number seven cylinder cracked, resulting in a loss of power.
• The aircraft was operating at low level (below 200 ft AGL) in an area where there were limited options available to conduct a forced landing.

Safety message

In this accident, the time available to manage the engine failure meant that there were few options in regards to the selection of a landing area. The accident highlights the importance of taking positive action and maintaining aircraft control when conducting a forced landing, while being aware of flare energy and aircraft stall speeds.

The Aerial Agricultural Association of Australia advised that there is nearly always an uncertainty about whether to dump the load and they suggest that the only safe rule is ‘if in doubt, dump’. In a high stress situation such as an engine failure where there is limited time, it is important to apply appropriate emergency procedures. To mitigate against the effect of stress compromising memory even in a minor emergency, pilots should have embedded motor programs to handle emergencies in reactive mode.

The pilot was wearing a helmet and commented that although they were ‘flung’ from side to side during the accident sequence, the seatbelt held them firmly in place.

Aviation Short Investigations Bulletin - Issue 59

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Ground personnel responsible for loading the chemical into the aircraft for spraying.
2. A magnetic device used to gather chips of metal from engine or transmission oil to provide early warning to maintenance personnel of impending engine failure. Depending on the installation, it can be linked to an in-cockpit indicating light to provide immediate advice to aircrew.

What happened

On 21 January 2017, the crew of an Airbus A320 aircraft, registered VH-VNC (VNC), prepared to conduct Tigerair flight 491 (TT491) from Cairns to Brisbane, Queensland. The flight crew consisted of a training captain and a first officer under supervision. The first officer was in the role of pilot flying for the sector and the captain was pilot monitoring.^[1]

The flight crew conducted a take-off and departure briefing based on the environmental conditions and runway in use, expecting to commence the take-off roll from the B5 taxiway intersection (Figure 1). They entered the take-off data into the iPad application and loaded the data into the flight management guidance computer.

At about 1511 Eastern Standard Time (EST), the surface movement controller (SMC) cleared the flight crew of a de Havilland DHC-8 (DHC-8) aircraft that had been parked on an adjacent bay to VNC, to taxi using taxiway C3 (and B) to holding point B4. About 30 seconds later, the SMC cleared the flight crew of VNC to taxi using taxiway C3 (onto taxiway B) to holding point B5, which was the clearance they had expected. The crew had briefed each other on that taxi route.

Figure 1: Cairns Airport diagram extract

Source: Airservices Australia – annotated by ATSB

VNC then taxied behind the DHC-8 along taxiway B. As the DHC-8 turned onto the runway at B4, the first officer of VNC inadvertently also taxied to holding point B4. After completing the ‘above the line’ pre-take-off checks (see Pre-take-off checks), at about 1515, the captain of VNC advised the aerodrome controller (ADC) that they were ready for take-off. The ADC cleared VNC to line up on the runway and, as the first officer taxied the aircraft onto the runway, the flight crew completed the ‘below the line’ pre-take-off checks.

About 1 minute later, the ADC cleared VNC for take-off. Immediately after the captain read back the take-off clearance, the ADC advised the crew that they were lined up at the B4 (not B5) intersection. The crew did not respond, so the ADC cancelled the take-off clearance and instructed them to hold position. The captain then confirmed that they needed to commence the take-off from B5. The ADC cleared them to turn around on the runway, exit using B4 and taxi to B5. The aircraft subsequently took off from the B5 intersection and the flight continued without incident.

There was a 403 m difference in available runway length, between the B4 and B5 taxiway intersections.

Pre-take-off checks

The pre-take-off checklist consisted of two parts: ‘above the line’ and ‘below the line’. The crew complete the first part (above the line) before reporting ready for take-off, and the second part (below the line) after the aircraft enters the runway.

Tower comment

The captain contacted the Tower controller after the flight to thank the controller for intervening and was advised that there had been a similar incident the previous day. The ATSB could find no record of any similar occurrences at Cairns Airport.

Safety analysis

Following the DHC-8

As the DHC-8 taxied immediately ahead of VNC, the flight crew may have been distracted by following the DHC-8 to B4. Although VNC had pushed back first, the DHC-8 flight crew had received their taxi clearance and commenced taxiing before VNC. There was no specific instruction to the flight crew of VNC to follow the DHC-8.

Cabin readiness

As the first officer turned the aircraft onto taxiway B4, the captain’s attention was on communicating with the cabin crew and observing their positions on the cabin video.

One of the items on the pre-take-off checklist (above the line) is ‘cabin ready’. The captain, as pilot monitoring, temporarily handed over responsibility for ATC communications to the first officer (as pilot flying), while they confirmed the status of the cabin. Because the captain had not heard the initial indication that the cabin was ready, they looked at the cabin video to check the cabin crew were seated and called the cabin crew on the interphone, who confirmed that the cabin was secure for take-off.

The captain then took back responsibility for ATC communications and returned their focus to cockpit activities. As the captain was busy liaising with the cabin crew as the aircraft turned onto B4, the likelihood that they would notice that the aircraft was approaching the runway on the incorrect taxiway was reduced.

Training flight

The first officer had completed 11 sectors and was under the supervision of the training captain. The first officer assessed their workload at the time as moderate. This was the first officer’s second flight into Cairns since joining the operator. The captain also commented that runway 33 was not the usual runway in use at Cairns (due to the prevailing winds). A lack of familiarity with the runway may have reduced the flight crew’s ability to detect the incorrect runway position when the aircraft was lined up on the runway.

The captain commented that the first officer was taxiing slightly faster than optimal coming up to the holding point. The captain may have been focused on monitoring the progress of the aircraft to ensure the aircraft stopped before the holding line, which may have distracted them from noticing the B4 taxiway sign (to the left of the taxiway).

Normally, the pilot flying would have completed the flight controls check earlier in the taxi and well before the holding point, but the first officer completed checking the controls as the aircraft approached the turn onto B4. The captain commented that the checks were all completed correctly and in the correct order, but slightly later than normal due to the relative inexperience of the pilot flying.

Pre-take-off checklist

The relevant ‘below the line’ check to confirm that the aircraft was prepared to take-off on the correct runway, was for the pilot flying to state ‘runway 33 confirm’, then the pilot monitoring to respond ‘runway 33 confirm’. While this checklist item provided confirmation of the runway, reference to an intersection was not part of the verbal check/response.

The first officer commented that confirming the intersection as well as the runway during the pre-take-off checks may prevent a similar incident occurring.

Potential overrun

The aircraft operator reviewed the ramifications of a departure from the B4 intersection with B5 performance take-off data. Initial calculations showed that in the event of a rejected take-off, either with all engines operating or one engine inoperative, would have resulted in a runway overrun.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The first officer taxied the aircraft to the runway holding point B4 instead of B5 and may have been distracted by following the DHC-8, which taxied immediately ahead of them and took off from the runway intersection with taxiway B4.
• The captain was communicating with cabin crew and looking at the cabin video as the aircraft turned onto taxiway B4, which probably distracted them from verifying that they had turned into the correct taxiway.
• Neither member of the flight crew recalled seeing the B4 holding point sign (to the left of the aircraft) at any time.
• The first officer was under training and had only been to Cairns once previously, and runway 33 was not the usual runway in use. Lack of familiarity with runway 33 may have reduced the flight crew’s ability to detect the incorrect runway position when the aircraft was lined up on the runway.
• The air traffic controller saw the aircraft at the incorrect intersection after clearing it for take-off and alerted the crew.
• There was potential for a runway overrun in a rejected take-off situation if the aircraft had commenced the take-off run from the B4 intersection.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, Tigerair has advised the ATSB that they are taking the following safety actions:

Safety awareness

Tigerair has distributed a Flight Training Notice to alert training and checking crew on both the A320 and B737 fleets to the event. Tigerair Safety will be publishing the event in their next Safety Spotlight newsletter.

Safety message

This incident highlights the importance of confirming that an aircraft is lined up for take-off at the correct intersection, or position on the runway, as well as the correct runway. Confirmation of runway heading is done by checking the aircraft’s magnetic heading with the runway direction once the aircraft is lined up on the runway. The intersection should be checked before the aircraft enters the runway.

Although this incident involved the use of an incorrect intersection rather than a wrong runway, a study conducted by the US Federal Aviation Administration in 2007, Wrong Runway Departures, outlines some relevant and important points. A class 2 electronic flight bag, which shows the aircraft’s location on a moving map display, is a technological enhancement described in the study as a safety enhancement to mitigate the risk of aircraft taking off from a wrong runway. The study identified a number of factors that contributed to aircraft taking off from an incorrect runway including:

• a similar layout, with one taxiway leading to an area with multiple runway thresholds located in close proximity to one another
• a short distance between the airport terminal and the runway
• a complex airport design
• the use of a runway as a taxiway
• a single runway that uses intersection departures.

Part of Aviation Short Investigations Bulletin - Issue 60

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Pilot Flying and Pilot Monitoring: procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.

On 21 October 2016, the ATSB was advised that the United States National Transportation Safety Board (NTSB) had commenced an investigation into a collision with terrain involving a Ryan W. Gross Arion Lighting, registered N235SC.

As Australia is the State of Manufacture of the engine, the ATSB requested to be appointed as an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.

The NTSB have determined the probable cause of the accident. Details are available on the NTSB website at https://www.ntsb.gov/_layouts/ntsb.aviation/brief.aspx?ev_id=20161101X12233

Any enquires relating to the investigation should be directed to the NTSB at: www.ntsb.gov

Safety summary

What happened

On the afternoon of 16 December 2016, the pilot of a Robinson Helicopter Company (Robinson) R22 Beta, registered VH-HPH and operated by North Australian Helicopters, was conducting mustering operations at Labelle Downs Station in the Northern Territory. About 12 km south‑west of the station property, the pilot was alerted to the onset of vibrations and conducted a precautionary landing. The landing was accomplished without incident. A subsequent ground inspection revealed the presence of a large crack through one of the main rotor blades.

What the ATSB found

Laboratory analysis of both main rotor blades (part number A016‑6) at the ATSB’s facilities in Canberra identified that a significant fatigue crack had propagated almost entirely through the blade chord at rotor station 61.3, which led to instability and vibrations of the aerofoil structure during the occurrence flight. The analysis identified that the fatigue crack initiated at the trailing edge bond line, and propagated through both the upper and lower blade skins until terminating at the leading edge D-spar.

It was possible that a number of variables influenced the initiation of the blade cracking, including the component’s design, manufacture and operation. The ATSB was unable to determine conclusively which factors, either individually or in combination, contributed to the crack initiation.

A search of aviation defect databases found no other examples of fatigue cracking in R22 A016-6 main rotor blades. The helicopter manufacturer reported to the ATSB that they were only aware of one other instance of A016-6 blade cracking.

What's been done as a result

Following the occurrence, on 22 December 2016, Robinson issued a Safety Alert ‘A016-6 Main Rotor Blade Crack’. It detailed the crack location, and recommended particular attention from pilots and maintainers when visually examining the trailing edges of blades during the daily or pre-flight inspection.

Robinson also redesigned the A016-6 main rotor blades to allow for a longer trailing edge doubler in order to eliminate potential stress gradients from stiffness variations along the trailing edge. A prototype A016-6 blade containing the extended doubler was test flown in January 2017, before entering production as Revision AV blades in February 2017.

The Australian Civil Aviation Safety Authority issued an Airworthiness Bulletin (AWB) 62-006 ‘R22 Main Rotor Blade Cracking’ to alert R22 operators and maintainers of the occurrence. The AWB was released on 23 December 2016 and highlighted the need for particular vigilance during the daily or pre-flight checks of the main rotors, and for pilots to be alert to sudden and increased vibrations.

Finally, North Australian Helicopters reinforced with staff the manufacturer’s recommended procedures for conducting the daily and pre-flight inspection of the main rotor blades and the need to land immediately should unusual vibrations increase or develop during flight.

Safety message

The ATSB reminds helicopter pilots, operators and maintainers that fatigue cracking can occur on critical flight components. Particular vigilance should be applied during the daily or pre-flight inspections as they represent an important opportunity to detect cracking. As recommended by Robinson in their Safety Alert, ‘A016-6 Main Rotor Blade Crack’, any form of damage such as paint blistering, denting, and corrosion to the main rotor blade surfaces is cause for further investigation. Pilots are also reminded to heed Robinson’s advice contained in Safety Notice 39 ‘Unusual vibration can indicate a main rotor blade crack’.

A catastrophic rotor blade fatigue failure can be averted if pilots and mechanics are alert to early indications of a fatigue crack.

If main rotor vibration rapidly increases or becomes severe during flight, make an immediate precautionary landing. Do not attempt to continue flight to a convenient destination.

Robinson R22 Beta, VH-HPH

Source: North Australian Helicopters

Context

Helicopter information

The Robinson R22 is a light-utility, two-seat helicopter, powered by a four-cylinder Textron Lycoming piston engine. At the end of 2019, there were 616 R22 helicopters on the Australian civil aircraft register. The Australian fleet is predominantly utilised for aerial stock mustering operations, which is a unique application, conducted in northern Australia during the dry season (April‑October).^[2] Flying training, business and private flights make up the remainder of the Australian fleet usage.

Helicopter history

The occurrence helicopter, serial number 3988, was manufactured in the United States (US) in 2005 and first registered in Australia as VH-HPH in January 2006. After importation and registration, the helicopter was introduced into service in northern Australia for mustering and other related purposes.

Over the next 5 years of operation, the helicopter accrued 1,738 hours total time in service (TTIS). In May 2011, during a routine inspection, the blades were identified as unserviceable due to denting and delamination of the aerofoil structure. The unserviceable blades, part number A016-4, were removed and replaced with a latter variant, part number A016-6 (Revision AR), serial numbers (SN) 0119 and 0133.

In November 2014, while operating out of Labelle Downs Station, the helicopter sustained a heavy landing due to the failure of a pitch link within the tail rotor assembly.^[3] A suspected rotor overspeed occurred during that incident, where the main rotor revolutions per minute (RPM) exceeded the certificated limit of 104 per cent (530 RPM). Both A016-6 main rotor blades were removed and submitted to an overhaul facility for repair.

Component history cards for the A016-6 blades, SN 0119 and SN 0133, indicated that they had accrued 1,018.7 hrs TTIS at the time of the hard landing. The blades were inspected and the blade spindles overhauled. No other defects or repair activity to the main rotor blades were documented in the component history cards. The blades were subsequently reinstalled while the helicopter underwent further repairs from the damage sustained in the heavy landing.

The last maintenance recorded in the helicopter logbooks was on 2 December 2016, at 3,500.9 hours TTIS for the routine 100-hour inspection. The helicopter was operated for an additional 31.8 hours after the 100-hour inspection. At the time of the precautionary landing, the helicopter had accrued 3,532.7 hours TTIS and both main rotor blades had accrued 1,794.7 hours TTIS.

Main rotor blade information

Robinson have progressively changed the main rotor blade design since the R22 Beta was first certified. Each major change in the construction or materials constituted a change to the part number. For example, one of the differences between the part number A016-2 and part number A016-4 blade was a redesigned root fitting. A minor design change was denoted by a change to the blade revision code, for example AR, AV etc.

The A016-6 main rotor blade variant incorporated an aluminium alloy upper and lower skin, replacing the stainless steel skin used in the previous A016-4 blade type. The A016-6 blades were life-limited^[4] parts that could be operated up until reaching 2,200 hrs TTIS, or 12 years from the date of the factory-issued authorised release certificate, whichever came first.

Blade manufacturing process

Manufacturing records obtained from Robinson for blades SN 0133 and SN 0119 showed that the A016-6 blades were made in separate batch lots over a five-month period commencing in September 2010. Structural adhesive was used to bond the upper and lower skin to the honeycomb core, D-spar and root fitting. A doubler reinforcement strip of stainless steel was bonded between the upper and lower skins at the blade trailing edge, terminating at rotor station 61 (measured 61 inches from the main rotor centreline). The assembled components were then clamped and heated under pressure at elevated temperature, allowing the adhesive to cure. A fillet of flexible epoxy sealant along the trailing edge bond line between the upper and lower skins provided protection from moisture ingress and corrosion.

Figure 3: Diagram of the A016-6 (Revision AR) blade

Source: Robinson Helicopter Company, annotated by ATSB

Manufacturing quality assurance

Part of the quality assurance checks during manufacture involved an inspection for defects associated with the adhesive bonding process. The surfaces of each blade were non-destructively inspected using a tap-test method to detect for voids between the bonded parts. No defects from the tap testing were noted in the manufacturing batch records for blade SN 0133 and SN 0119.

Coupons^[5] from each blade were also mechanically tested to assess the strength of the adhesive bonding. The results contained in the batch records for each blade confirmed that the cured adhesive was at a maximum strength condition.

History of related main rotor blade failures

Early-variant R22 main rotor blades

Since 1996, state agencies and regulatory authorities have conducted several R22 accident investigations^[6] due to in-flight fracture and separation of the A016-2 main rotor blade-type. Fatigue cracking was found to have initiated within a bolt hole associated with the blade root fitting. Those failures prompted a redesign of the root fitting by Robinson, issuing the A016-4 blade in 2004. The Civil Aviation Safety Authority (CASA) issued an Airworthiness Directive^[7] in February 2006 that required all Australian operators remove the A016-2 blades from service and replace them with the A016-4 variant.

Following a fatal accident^[8] associated with skin-to-spar line delamination of an A016‑4 main rotor blade, and further instances of skin-to-spar delamination across the R22 fleet, an Airworthiness Directive^[9] was released by the US Federal Aviation Administration (FAA) in 2011 that enhanced the existing blade inspection requirements. An additional FAA Airworthiness Directive^[10] became effective in 2015, requiring the replacement of all A016-4 blades with the alloy‑skinned A016-6 variant within a five-year period.

Other A016-6 blade cracking occurrences

The ATSB investigation conducted a search of the CASA and the FAA service difficulty-reporting databases. These databases allow operators, owners and maintainers to report and view major defects with aircraft or parts. No other instances of A016-6 main rotor blade cracking were recorded in either database.

Robinson advised the ATSB that they were aware of one other occurrence of cracking involving an A016-6 main rotor blade. The cracking occurred at a similar location as that identified in blade SN 0133, from VH-HPH. The blade was fitted to an R22 based in Mexico performing tuna spotting operations in a coastal environment (Figure 4). Robinson advised that the operator had attempted an unauthorised repair by stop drilling^[11] the crack tip, however the cracking progressed to the leading edge spar, prompting the blade to be removed from service prior to complete failure. The defective blade had accrued 1,800 hours TTIS.

Figure 4: Cracking in an A016-6 blade from a Mexican R22

Source: Robinson Helicopter Company; annotated by ATSB

A016-6 main rotor blade design change

During the course of this investigation, Robinson advised the ATSB that they had conducted a minor redesign of the A016-6 main rotor blades. The redesign included extending the length of the A302 stainless steel doubler that was adhesively bonded along the trailing edge of the A016-6 blade. The length of the doubler was extended further outboard, terminating beyond the chord transition at rotor station 96 (Figure 5).

Robinson further advised that the intent of the A302 doubler extension was to minimise the potential stress gradient as a result of the change in stiffness at that location. Revision AV A016-6 blades containing the extended doubler were test-flown in January 2017 and subsequently implemented into production in February 2017.

Figure 5: Robinson A016-6 blades showing the extended A302 trailing edge doubler (highlighted) in the latter Revision AV blades

For the newer Revision AV main rotor blades, the trailing edge doubler was extended outboard from rotor station 61 (near the point of cracking in this occurrence) to rotor station 96.

Source: Robinson, modified by ATSB.

Previous research – R22 aerial mustering usage profile

The ATSB previously^[12] commissioned an engineering analysis to study the forces acting on a Robinson R22 while engaged in aerial mustering operations. The study provided a comparison of the flight profiles in Australian aerial mustering operations and compared these with the flight profiles used for certification.

The published report found that for the R22, aerial mustering exhibited frequent low-speed manoeuvring and rapid power changes. The report found that throughout a mustering season, many flights were short in duration, with the major proportion spread over a time period ranging from 10 to 60 minutes. Higher loads and associated peak stresses were also found to develop in the helicopter drive system (including the main rotor blades) during those flights when compared against the certification flight profile. The report concluded that:

Light utility helicopters are likely to remain engaged in aerial mustering operations. The R22 has been the most popular model for these types of operations, but owners and operators need to fully appreciate the stresses placed on aircraft during mustering operations, and the characteristics of aerial mustering operations, which may be quite different to the type of flying for which the type originally received certification.

Major stresses within a helicopter main rotor blade are created at the commencement of each flight cycle when the blades are accelerated and lift forces generated, (Prouty, 1988). Three types of primary blade loading conditions create variable alternating stresses in the blades during operation of the helicopter, (FAA, 2019):

• loading from rotation of the main rotor assembly as a function of main rotor speed leading to axial stresses at the blade hub
• out-of-plane loads that are produced by lift that result in upward bending of the outer sections of the main rotor blades
• in-plane bending loads from drag forces that are generated by main rotor rotation and helicopter flight.

Main rotor blade inspection requirements

Guidelines for the scheduled inspection of the main rotor blades are contained in the Robinson R22 Maintenance Manual and the Pilot’s Operating Handbook (POH). Until the 2,200 hour or 12 year life-limit is reached, the required inspections that relate to the main rotor blades consist of the daily or pre-flight, and the 100-hourly or 12 month annual inspection, whichever comes first.

100-hour inspection

A detailed visual inspection and a tap test^[13] of fatigue critical areas of each main rotor blade was required as part of the 100-hour inspection outlined in Section 2.410 of the R22 Maintenance Manual was. The specific detail for that inspection listed in Section 9.410 of the manual required inspection for damage such as scratches, dents, voids and local deformations.

Visual inspection is widely used for detecting and examining aircraft surfaces for cracks, which are particularly important because of the relationship to structural failures, (FAA, 2018). Visual inspection aids such as a flashlight, a mirror, or a magnifying glass may be used to aid the inspection process. A work stand or platform is typically required to access the main rotor blades due to their height above the ground.

No defects associated with the main rotor blades of the occurrence helicopter were recorded in the maintenance records from the last 100-hour inspection.

Daily or pre-flight inspections

It is an Australian regulatory requirement that the daily or pre-flight inspection be performed in accordance with the R22 Pilot’s Operating Handbook (POH) by either a licensed aircraft maintenance engineer, a pilot endorsed on the aircraft type, or an otherwise approved person. The daily or pre-flight inspections of the helicopter are intended to provide a regular opportunity to ensure the airworthiness and satisfactory general condition of the helicopter. Section 4 of the R22 POH provides a list of items that require direct inspection. With regard to the main rotor blades, the POH issues the following requirement:

Main Rotor

Blades . . . . . . . . . . . . . . . . Clean and no damage / cracks

The maintenance release issued to VH-HPH that was current at the time of the occurrence confirmed the completion of the required daily inspections, with no record of any blade defects.

Manufacturer’s safety advice

Safety notice

In July 2003, Robinson published Safety Notice SN-39, ‘Unusual Vibration Can Indicate a Main Rotor Blade Crack’. The notice was required to be inserted at the rear of the R22 POH, and provided advice to pilots and operators on the association between main rotor vibrations and the potential development of fatigue cracks:

UNUSUAL VIBRATION CAN INDICATE A MAIN ROTOR BLADE CRACK

A catastrophic rotor blade fatigue failure can be averted if pilots and mechanics are alert to early indications of a fatigue crack. Although a crack may be internal to blade structure and not visible, it will likely cause a significant increase in rotor vibration prior to final failure. If a rotor is smooth after balancing but then goes out of balance again within a few flights, it should be considered suspect. Have the rotor system thoroughly examined by a qualified mechanic before further flight.

If main rotor vibration rapidly increases or becomes severe during flight, make an immediate safe landing. Do not attempt to continue flight to a convenient destination.

Laboratory examination

Visual examination

The upper surface of each blade is shown as it was received at the ATSB’s engineering laboratory in Figure 6. Manufacturing identifiers were contained on a data plate fixed to the blade root region, containing the following detail:

Cracked blade: part number A016-6, Revision AR, Serial Number 0133

Partner blade: part number A016-6, Revision AR, Serial Number 0119

Measurements showed that the crack in SN 0133 was located approximately 156 cm (61.3 inches) from the rotor centreline, or alternately, approximately 226 cm (90 inches) when measured from the blade tip. Design drawings supplied by Robinson identified that the location of cracking was coincident with the termination of the adhesively bonded trailing edge A302 doubler at rotor station 61. An overall condition assessment of the blade did not identify any surface damage representative of a main rotor strike to a foreign object. No rippling, creasing or deformation to the main rotor blade aerofoil surfaces were identified that might have otherwise been attributable to vibration or a hard landing.

The trailing edge of blade SN 0133 surrounding the cracking was examined in detail at higher magnification using a stereo optical microscope. Minor surface corrosion, sealant and paint loss was evident at the trailing edge bond line (Figure 7). Qualitatively, very little corrosion product was present on the surfaces surrounding the trailing edge crack, with no evidence of deeper corrosion pitting identified. No other damage such as denting, notches or mechanical abuse was identified along the crack line that might otherwise have been contributory.

A visual examination of the partner blade, SN 0119, was also conducted. Blade SN 0119 was undamaged. There was no evidence of buckling, denting, gross deformation, or impact marks that might have provided an indicator of an operational abnormality such as a tree or wildlife strike, or a hard landing. Importantly, examination of the surfaces surrounding rotor station 61 did not reveal any cracking, corrosion or paint loss.

Figure 6: Both main rotor blades from VH-HPH, as received and compared against the A016-6 plan drawing

Source: Blade diagram Robinson, blade images ATSB

Figure 7: Trailing edge corrosion damage and paint loss to the lower surface of blade SN 0133 at rotor station 61.3

Minor surface corrosion, paint loss and bead sealant damage was identified near the crack origin on both the upper and lower surfaces.

Source: ATSB

Fractography - optical examination

Blade SN 0133 was destructively cross-sectioned at rotor station 60 and 62 to allow separation of the blade halves and further detailed assessment. The surface features indicate that cracking of the blade aerofoil occurred from the trailing edge bond line, propagating through the upper and lower skins, the adhesive and the honeycomb core, before terminating close to the leading edge D-spar. The mechanism of crack growth was established to be fatigue, that is, crack initiation and progressive crack extension in response to the development of a number of repeated localised alternating stresses during operation.

The significant fracture features show three distinct regions (Figure 8):

• A region of flat, transgranular fatigue cracking extending from the trailing edge bondline forward approximately 16 mm.
• A region from 16 mm to 91 mm comprising a mixed-mode crack growth mechanism. The features in the mixed-mode region were predominantly flat and transgranular in nature, consistent with metastable, high-cycle crack growth; however, these were punctuated by pockets of tensile tearing.
• A region of ductile overstress tearing from 91 mm to 151 mm at the crack tip.

A high-magnification optical study of the surfaces at the trailing edge fatigue crack origin identified a minor level of surface corrosion that had developed up to the transition into the mixed-mode region (Figure 9). The presence of the corrosion was consistent with an extended period of environmental exposure. Though difficult to quantify, corrosion of this nature takes time to form, indicating that it had been present for considerably longer than the occurrence flight. Aside from the surface corrosion, no macro features were identified that might have contributed to the initiation of the cracking.

Further along the crack surface, in the mixed-mode region, approximately 58 major progression bands were identified. There was an absence of corrosion in this region, and the surfaces appeared bright and fresh, which suggested that the cracking through the blade surface was relatively recent. An example of a progression band is shown at Figure 10.

Figure 8: Fracture surface measurements of main rotor blade SN 0133

The cracked blade was cut open, exposing separate areas along the fracture surface; fatigue, fatigue mixed-mixed-mode and overstress. Corrosion was identified along the blade fracture surfaces up until the crack had reached approximately 16mm in length.

Source: ATSB

Figure 9: Fatigue crack surface showing minor corrosion close to the origin

The corrosion extended for approximately 16mm along the blade skin crack surfaces, up until the mixed-mode region.

Source: ATSB.

Figure 10: Progression bands (arrowed) in the mixed-mode region along the fracture surfaces of the upper and lower skins

Source: ATSB

Scanning electron microscopy

A scanning electron microscope (SEM) was used to further characterise the crack surfaces of the upper and lower skins. The SEM examination confirmed that many of the finer features of the fatigue portion of the fracture were obscured by a fine flayer of surface oxidation. Cracking in the initial fatigue portion of the blade was confirmed to be entirely transgranular with many finely spaced striations of less than 1 micron in length (Figures 11 and 12). The fine detail of the striation spacing, in combination with the lack of tensile tearing, would suggest that the crack growth rate up until the mixed-mode boundary was due to high cycle fatigue. The SEM examination was unable to identify any micro or macroscopic features at the trailing edge bond line that might otherwise have initiated the cracking.

Figure 11: SEM image of the trailing edge origin also identifying the direction of fatigue crack growth

Source: ATSB

Figure 12: SEM image of the fracture within the fatigue region identifying fine striations consistent with high-cycle fatigue

Source: ATSB

Non-destructive inspection

The main rotor blade section was submitted^[14] for non-destructive inspection. The cracked blade section was x-rayed using micro-computed tomography (micro-CT). That technique created a series of x-ray images subsequently processed into a high-resolution three-dimensional model (Figure 13). The structure of the blade was studied for characteristic features and defects that might have contributed to the development of cracking in the blade.

The high-resolution micro-CT model confirmed that cracking in the skin was located 7 mm outboard of the A302 stainless steel doubler termination. Some porosity was identified in the adhesive that bonded the upper and lower skins. Porosity is an artefact of the curing process related to the pre-cured adhesive absorbing moisture from high-humidity environments. Porosity can lead to cohesive failure between the adhesive and substrate, (Davis, 2008). In this instance, the porosity was forward of the trailing edge crack origin and was therefore considered unlikely to have influenced the cracking through the blade skins.

The high-resolution model of the blade also allowed the investigation to discount the presence of defects such as significant voids or regions of adhesive disbonding that might have otherwise contributed to the crack growth at rotor station 61.3.

Figure 13: Micro-computed tomography images of the cracked region in blade SN 0133

Scan detail: Australian National University CT Lab, Heliscan micro-CT instrument, x-ray energy 120 kilovolts, resolution 24-micron.

Source: ATSB

__________

2. Australian Transport Safety Bureau, Research Report BE04/73, Light utility helicopter safety in Australia, 2004
3. Australian Transport Safety Bureau, Investigation AO-2014-181, Tail rotor malfunction involving a Robinson R22, registration VH-HPH, Labelle Downs Station, Northern Territory on 18 November 2014
4. Federal Aviation Administration Code of Federal Regulations, CFR 43.10, Life-limited part means any part for which a mandatory replacement limit is specified in the type design, the Instructions for Continued Airworthiness, or the maintenance manual. Life status means the accumulated cycles, hours, or any other mandatory replacement limit of a life-limited part.
5. Robinson main rotor blades contain additional blade material for machining into test coupons. Mechanical testing of the coupons to an industry standard allows the determination of common static or dynamic mechanical properties. In this case, Robinson assessed for cohesive and adhesive bond strength.
6. ATSB Aviation investigation 200302820, VH-OHA, Bents Basin State Recreation Area, NSW, 20 June 2003.
   ATSB Aviation investigation 200003267, VH-LDR, Yarromere Station, Qld, 29 July 2000.
   ATSB Aviation investigation 199000089, VH-HBS, 27 May 1990.
   State of Israel Ministry of Transportation investigation, Accident No. 6-04, 4X-BCM, 29 February 2004.
   New Zealand Civil Aviation Safety Authority investigation 04/3712, ZK-HWP, November 2004
7. CASA AD/R22/53, Main Rotor Blades, 2/2006
8. NTSB Investigation No. WPR10WA070, Robinson R44, 4X-BDM, Netany Bay, Israel, 24 November 2009
9. US Federal Aviation Administration, Airworthiness Directive, 2011-12-10 Robinson Helicopter Company Helicopters, 17 June 2011
10. US Federal Aviation Administration, Airworthiness Directive, 2014-23-16 Robinson Helicopter Company
11. Stop drilling is a technique to enhance the life of a cracked structure that involves drilling a small circular hole at the crack tip.
12. ATSB Aviation Research and Analysis report – B2004/0292, Robinson R22 helicopter aerial mustering usage investigation, October 2007.
13. A basic non-destructive method using a coin to determine voids and areas of debonding in composite materials via the change in sound associated with these defects when the surface is tapped.
14. The National Laboratory for X-ray Micro Computed Tomography (CTLab) is based at the Australian National University in Canberra and the blade was imaged using their HeliScan micro-CT system.

The occurrence

On the afternoon of 16 December 2016, a Robinson Helicopter Company (Robinson) model R22 Beta (R22) helicopter, registered VH-HPH, was being operated on an aerial stock mustering flight at Labelle Downs Station in the Northern Territory. The helicopter was approximately 12 km from the station homestead when the pilot noted the onset of vibrations. In response, the pilot conducted a precautionary landing and shutdown the helicopter. A subsequent inspection revealed a significant crack in one of the main rotor blades. The crack had progressed almost entirely through the blade cross-section (Figures 1 and 2).

Figure 1: The main rotor blade crack is identified near rotor station 61

The measurement scale positioned along the trailing edge is from the blade tip.

Source: North Australian Helicopters, annotated by ATSB

Both main rotor blades were removed from the helicopter, packaged, and transported to the ATSB for laboratory examination. Initial inspection confirmed that an extensive chord-wise^[1] crack had propagated from the trailing edge through both the upper and lower blade skins, stopping just short of the leading edge D-spar.

Figure 2: Closer view of the cracked main rotor blade from the lower surface

Source: North Australian Helicopters, annotated by ATSB

__________

1. The front of a rotor blade is identified as the leading edge; the rear of the blade is the trailing edge. The chord is the distance from the leading edge to the trailing edge.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Robinson Helicopter Company
• North Australian Helicopters
• United States National Transportation Safety Board
• New Zealand Transport Accident Investigation Commission
• United States Federal Aviation Administration
• Civil Aviation Safety Authority.

References

• Drury, C. and Watson, J. (2007). Good practices in visual inspection
• Federal Aviation Administration. (1997). Visual Inspection for Aircraft, Advisory Circular AC No: 43-204
• Federal Aviation Administration. (2008) Aviation Maintenance Technician Handbook – General
• Davis, M. and Bond, D. (2008). The importance of failure mode identification in adhesive bonded aircraft structures and repairs, Royal Australian Air Force

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, North Australian Helicopters, Robinson Helicopter Company, the pilot-in-command, the United States Federal Aviation Administration and National Transportation Safety Board.

Submissions were received from the Robinson Helicopter Company, North Australian Helicopters, the pilot-in-command and the Civil Aviation Safety Authority. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Safety analysis

Introduction

The precautionary landing involving a Robinson Helicopter Company (Robinson) R22 Beta helicopter, VH-HPH, near Labelle Downs Station, Northern Territory, on 18 December 2016 was precipitated by the development of undetected fatigue cracking through the aerofoil of one of its main rotor blades. The cracking led to increased vibrations, prompting the pilot to conduct a precautionary landing. Although Robinson R22 main rotor blades have previously exhibited critical failures (root fitting cracking in the A016-2 variant, and skin-to-spar bond line deterioration and delamination in the A016-4 variant), the issue of fatigue cracking through the blade chord for the A016-6 variant has not previously been investigated. This analysis will examine the potential factors that may have led to the blade cracking.

Blade cracking

The ATSB’s technical examination of the fracture surfaces revealed that the main rotor blade, part number A016-6, serial number 0133, Revision AR, had cracked due to exposure to cyclic loading. The cracking initiated just outboard of rotor station (RS) 61 on the trailing edge of the blade and progressively grew forward along the chord line toward the D-spar. No initiating defects were identified. A high-magnification study of the fatigue crack origin did not identify any contributing defects such as corrosion pitting, external damage, deformation, or metallurgical anomalies in the blade skins that might otherwise have contributed to the crack initiation.

The physical appearance and morphology of the fracture surfaces, in combination with the development of the corrosion along the fracture, suggested an extended period of comparatively slow and stable growth, greater than the duration of the occurrence flight. While the examination was unable to conclusively determine the period over which the cracking had developed, corrosion product formation suggested that the blade crack was at least 16 mm in overall surface length before the occurrence flight.

Major stresses within a helicopter main rotor blade are created at the commencement of each flight cycle when the blades are accelerated, and lift forces generated. Of the three types of primary loading conditions that create alternating stressing in the blades during operation of the helicopter, the location of the cracking in this instance was consistent with it being driven predominantly by alternating out-of-plane bending loads. The magnitude of this load will vary with the magnitude of the lift forces on the rotor blade. As the blade crack grew and transitioned from almost pure fatigue to a mixed-mode mechanism, manoeuvring loads in combination with flight cycles are likely to have influenced its growth.

Crack initiation factors

The investigation considered the elements that may have been a contributor, either individually, or in combination, to the development of cracking of the main rotor blade. These included the:

• operation of the helicopter and its previous heavy landing and associated overspeed
• manufacture of the main rotor blades
• main rotor blade design.

Operation – heavy landing and overspeed

In December 2014, while operating out of Labelle Downs Station, the helicopter sustained a heavy landing and a suspected main rotor overspeed after losing tail rotor control. The incident necessitated blade removal and inspection. After the blades were inspected and the spindles repaired, they were returned to service. Both blades were operated for an additional 778 hours up until the failure, accumulating 1,794.7 hours total time in service, well short of their life-limit of 2,200 hours. It is possible that the heavy landing overstressed the rotor system and, in combination with its mustering usage, produced a level of fatigue damage to the aerofoil of blade SN 0133 that was not detectable during the blade inspection. This potential damage was unable to be quantified by the investigation, and it could not be concluded that the operation-type or previous damage sustained was a contributing factor to the blade cracking.

Manufacture

The integrity of the adhesive bonding between the assembled parts is a critical factor in assuring ongoing airworthiness of the main rotor blades. The ATSB’s technical examination did not identify any gaps or delamination in the adhesive and surrounding areas at the trailing edge that might have contributed to the crack initiation. Some entrained porosity was identified in the adhesive bonding between the upper and lower blade skins forward of the fatigue crack origin. Although significant porosity can affect the bond strength between parts, in this instance the location and minor extent of porosity was unlikely to have influenced the crack initiation.

Design

A design feature of the A016-6 blades was the use of an adhesively bonded, thin strip of stainless steel that acted as a doubler along the trailing edge between the upper and lower skins. The doubler extended outboard from close to the hub, stiffening the trailing edge and terminating at RS 61. The investigation identified that crack growth in the blade had initiated close to where the doubler had ended. A reduction in stiffness and an associated stress gradient within the upper and lower skins was likely to be present as a result of the doubler termination.

The manufacturer has taken steps to redesign the part, extending the trailing edge doubler from RS 61 to RS 96. Though a stress gradient likely existed at RS 61, without the conduct of a detailed strain analysis, the ATSB was unable to determine if the doubler termination likely influenced the cracking.

Fatigue crack detectability

Part of the scheduled maintenance for the helicopter involved inspecting the main rotor blades throughout their service life. A detailed visual inspection and tap test of the blades for dents, delamination, debonding, scratches and corrosion was required during each 100-hourly inspection. The helicopter’s maintenance records indicated that no defects were detected in the blades from the previous inspection, which was completed approximately two weeks prior to the occurrence.

Similarly, the daily pre-flight inspections were signed off in the maintenance release, indicating that no defects were present. Although the records indicated that both types of inspection had been conducted, the corrosion product on the blade skin fracture surfaces (which takes time to develop) suggests that the cracking was, at the very least, present prior to the occurrence flight. It could not be determined with certainty whether the crack was present during the last 100-hourly inspection.

The R22 pilot’s operating handbook did not define specific criteria while conducting a visual inspection of the main blades during the daily inspection, for example: preparation of the surface, ambient lighting requirements, the use of a work platform, or visual aids such as a torch or magnifier. The daily instructions are non-specific and are intended for the identification of gross and obvious defects, therefore reducing the potential for a relatively short surface crack to be detected.

The fine detail describing the crack features was possibly concealed due to the effects of surface compression from natural blade droop. Further reducing the probability of detection was the fact that only the black painted underside of the blade would have been visible during the pre-flight inspection. The dark surface, in combination with its overhead position and the short surface length of the crack may have masked subtleties in surface contrast on the underside of the blade during an inspection.

Other factors that can influence the probability of detection include the frequency and history of cracking in the subject area or component. This was the first instance of A016-6 main rotor blade cracking within the Australian R22 fleet. If there is no history of a defect, there is less expectation for finding a fault, potentially affecting the level of scrutiny that an area with a history of cracking might prompt. Conversely, a special inspection that is triggered to address a particular airworthiness consideration, such as a Service Bulletin, Airworthiness Directive, Airworthiness Bulletin or Service Letter, adds to the expectation that a defect is likely to be found in the subject location.

Precautionary landing

The action to land was appropriate in respect of the published advice contained within the Robinson safety notice SN-39, stating that:

Unusual vibration can indicate a main rotor blade crack.

If main rotor vibration increases or becomes severe during flight, make an immediate safe landing.

Had the pilot elected to continue operating the helicopter, there was an increased potential for an in-flight loss of control due to further deterioration of the blade aerofoil surfaces.

Appendices

Appendix A: R22 safety alert

Appendix B: Airworthiness bulletin

Findings

From the evidence available, the following findings are made with respect to the main rotor blade cracking and precautionary landing of a Robinson Helicopter Company R22-Beta, registered VH‑HPH that occurred 12 km south-west of Labelle Downs Station, Northern Territory on 16 December 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The A016-6 (Revision AR) main rotor blade developed progressive fatigue cracking that initiated at the trailing edge of the blade. The crack propagated through the upper and lower skins until its growth became unstable, leading to vibration in the rotor system that prompted the pilot to conduct a precautionary landing.

Other findings

• The ATSB was unable to determine conclusively the factors that influenced the fatigue crack initiation and propagation in the A016-6 (Revision AR) main rotor blade.
• The fatigue cracking was probably present in the main rotor blade prior to the occurrence flight, however the cracking may have been difficult to detect during the conduct of the daily inspection.
• The pilot’s action to land the helicopter prevented further deterioration of the main rotor blade surface and eliminated the potential for an in-flight blade separation and subsequent loss of control.

Safety issues and actions

Proactive safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Robinson Helicopter Company

• On 22 December 2016, Robinson Helicopter Company issued a Safety Alert that detailed the location of the incident blade’s crack and recommended close visual inspections of the trailing edges of blades during daily pre-flight inspections (Appendix A).
• Following this occurrence, in February 2017 Robinson commenced a minor redesign of the A016-6 blades. The reinforcing doubler at the trailing edge of the blade was extended further outboard from rotor station 61 to rotor station 96, with the intention of reducing any potential stress gradients over that region of the blade.

Civil Aviation Safety Authority

On 23 December 2016, the Civil Aviation Safety Authority issued an Airworthiness Bulletin AWB 62-006 ‘Alert – R22 Main Rotor Blade Cracking’ (Appendix B). The AWB was intended to alert R22 operators to the development of a significant crack that was identified from this occurrence. The AWB also highlighted the need for particular vigilance during the daily pre‑flight checks of the main, and for pilots to be alert to sudden and increased vibrations.

North Australian Helicopters

North Australian Helicopters reinforced with staff the manufacturer’s recommended procedures for conducting the daily and pre-flight inspection of the main rotor blades and the need to land immediately should unusual vibrations increase or develop during flight.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 28 December 2016, the ATSB was advised that the United States National Transportation Safety Board (NTSB) had commenced an investigation into a partial power loss and collision with terrain involving a Mathias Lightning aircraft registered N59JL. The Aircraft was substantially damaged when it impacted terrain while maneuvering in the traffic pattern at Franklin Municipal-John Beverly Rose Airport, Franklin, Virginia. The commercial pilot sustained minor injuries and the passenger sustained a serious injury.

The airplane was operated under the provisions of 14 Code of Federal Regulations Part 91 as a personal, local flight. Visual meteorological conditions prevailed at the time and no flight plan was filed for the flight which was originating at the time of the accident.

As Australia is the State of Manufacture of the engine, on 9 January the ATSB appointed an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB investigation on 9 January. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.

The NTSB determined the probable cause of the accident. Details are available on the NTSB website. 

The NTSB’s final report is available on the NTSB website. 

Any enquires relating to the investigation should be directed to the NTSB at : www.ntsb.gov.

What happened

On 15 November 2016, at about 1150 Eastern Daylight-saving Time (EDT), a Ryan STA-SPL aircraft, registered VH-SQD, departed from Tyabb aircraft landing area (ALA), Victoria, for a private local pleasure flight. The pilot was the sole occupant of the aircraft.

About 10 minutes after take-off, when at about 1,000 ft above mean sea level, the aircraft’s engine suddenly stopped, then briefly restarted and then stopped again. The pilot conducted a forced landing into a field. The aircraft landed heavily and with a tailwind, and the pilot assessed that the aircraft may not slow down sufficiently before a fence up ahead. The pilot therefore used the available airspeed to take-off again and fly the aircraft about 15 ft over the fence. The pilot aimed the aircraft’s wing at a tree to reduce the remaining speed and ensure it stopped prior to a major freeway. The aircraft collided with the tree, then the ground and was substantially damaged (Figure 1). The pilot sustained a minor injury.

Figure 1: Accident site showing damage to VH-SQD

Source: Victoria Police

Engineering report

A post-accident inspection found no evidence indicating the cause of the engine failure.

Pilot comments

The pilot reported that their priorities in the event of engine failure were to control the aircraft, land as soon as possible, and get rid of any excess energy (speed). The conditions may have been conducive to carburettor icing, but the aircraft was not fitted with carburettor heat.

Weather conditions and carburettor icing

The temperature at the time of the accident was 14 °C, the relative humidity 76 per cent, and the dew point depression 4 °C. According to the carburettor icing probability chart (Figure 2), there was a serious risk of carburettor icing at any power setting.

Figure 2: Carburettor icing probability chart

Source: CASA – annotated by ATSB

Safety analysis

The engine probably stopped due to carburettor icing, and the aircraft was not (and was not required to be) fitted with carburettor heat.

The aircraft was below 1,000 ft above ground level when the engine failed and the pilot had limited options for landing sites. The pilot landed the aircraft with a tailwind component, and directed the aircraft towards a tree to reduce the ground roll and prevent the aircraft continuing onto a freeway.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The engine probably failed due to carburettor icing, at relatively low level and with few options for the pilot to safely conduct a forced landing.

Safety message

It is essential to have a plan and practise simulated forced landings to assist in reducing the consequences of conducting one in the event of engine failure. The height above ground at which an engine failure occurs affects the time available to complete failure management checks and select an appropriate landing site.

Aviation Short Investigations Bulletin - Issue 56

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 10 January 2017, at about 1030 Eastern Standard Time, a Cessna 172M, registered VH‑WTQ, departed Agnes Water aeroplane landing area (ALA), Queensland on a passenger charter flight to a beach ALA on Middle Island. There was a pilot and three passengers on board.

At about 1038, the pilot was conducting an airborne inspection of the beach ALA to ensure that it was suitable for a landing. During the inspection, when the aircraft was at about 60 ft above mean sea level (AMSL), the aircraft’s engine had a sudden and total power loss.

After conducting initial checks, the pilot elected to conduct a significant left turn to the beach. During the continued turn, the aircraft impacted the beach with little or no control and a significant descent rate. One of the rear-seat passengers was fatally injured and the other three occupants sustained serious injuries. The aircraft was destroyed.

What the ATSB found

Despite a detailed inspection of the engine and related systems, the ATSB was unable to identify the reason for the loss of engine power. Nevertheless, the ATSB found that the operator’s procedures and practices for conducting airborne inspections of the Middle Island ALA did not effectively manage the risk of an engine failure or power loss when at a low height. The inspections were generally flown at 50–100 ft AMSL while flying at normal cruise speed towards an area of water at the end of the beach, with no planned consideration of what to do in the event of an emergency.

Although not found to be contributing to the accident, there were a number of other problems identified with the operator’s activities. The documented flight hours for the aircraft underestimated the actual flight hours. In addition, for the accident flight, the aircraft exceeded the maximum take-off weight and the baggage and supplies on the aircraft were not effectively secured. The ATSB also identified safety issues with the operator’s practices for calculating weight and balance, securing loads, and the conduct of near-aerobatic manoeuvres during passenger charter flights with limited controls in place to manage the risk of such manoeuvres. More generally, the operator had no effective assurance mechanisms in place to regularly and independently review the suitability of its activities.

The aircraft’s rear seats were not equipped with upper torso restraints (shoulder belts or harnesses). Such restraints were not required for seats (other than in the front row) of small aeroplanes manufactured prior to December 1986, however, numerous international investigation agencies (including the ATSB) and some aircraft manufacturers have recommended they be fitted. Had such restraints been fitted, the rear-seat passengers’ injuries would very likely have been less severe.

Although the operator’s primary activity since July 2009 was passenger transport flights to beach aeroplane landing areas (ALAs), regulatory oversight by the Civil Aviation Safety Authority (CASA) had not examined the operator’s procedures and practices for conducting flight operations at these ALAs. It was difficult to determine whether additional focus on this topic during surveillance would have identified the problems associated with the operator’s airborne inspections. Nevertheless, the ATSB identified a safety issue with CASA’s procedures and guidance for scoping surveillance events.

What's been done as a result

Following the accident, CASA requested the operator to cease flight operations under its Air Operator’s Certificate (AOC). On 27 January 2017, CASA issued the operator with a notice of immediate suspension of its AOC, and on 10 March 2017 the operator requested that CASA cancel its AOC.

CASA has stated that it will not be mandating the fitment of upper torso restraints, even for air transport flights in small aircraft. Given that a significant number of small aircraft in Australia still do not have upper torso restraints in non-front row seats, the ATSB has issued a safety recommendation to CASA. The ATSB recommends that CASA consider mandating the fitment of upper torso restraints for all seats in small aircraft, particularly those used for air transport operations and/or aircraft where the manufacturer has issued a mandatory service bulletin to fit upper torso restraints for all seats.

While this is being considered by CASA, the ATSB has issued a safety advisory notice to encourage all owners and operators of small aircraft to fit upper torso restraints for all passenger seats to minimise injury risk.

CASA has also advised that air transport operators of small aeroplanes will be required to brief passengers about when and how to adopt a brace position.

Finally, the ATSB has issued a safety recommendation to CASA to improve its procedures and guidance for scoping surveillance events.

Safety message

This accident reinforces standard pilot training and guidance that, following an engine power loss at a low height, an emergency landing should (in most cases) be planned straight ahead with only small changes in direction to avoid obstructions. Operators and pilots should review their flight procedures to ensure that such emergency landings are possible when their aircraft are at a low height. If such landings are not possible, or the lowest risk option available, then the suitability of the flight activity should be evaluated.

Operators and pilots that conduct airborne inspections of landing areas should also ensure that the risk of an engine failure or power loss is considered when planning and conducting such inspections at a low height, particularly when below 500 ft.

The occurrence

Overview

On 10 January 2017, a Cessna 172M, registered VH-WTQ, was being operated by Wyndham Aviation Pty Ltd on a passenger charter flight from Agnes Water aeroplane landing area (ALA), Queensland to a beach ALA on Middle Island, about 12 NM (22 km) to the north-west. There was a pilot and three passengers on board.

The flight departed at about 1030 Eastern Standard Time.^[1] At 1036 the pilot commenced descent and soon after he was approaching the landing area from the south to conduct an airborne inspection of the ALA. While flying parallel to the beach and landing area, at about 60 ft above mean sea level (AMSL), the engine sustained a sudden and total power loss.

After conducting initial checks, the pilot turned left towards the beach. During the continued turn, the aircraft impacted the beach. One of the rear-seat passengers was fatally injured and the other three occupants sustained serious injuries. The aircraft was destroyed.

Background information about the flight

On the morning of 10 January 2017, the operator was transporting 12 passengers from Agnes Water ALA to the Middle Island ALA, which was located next to a camp site where the passengers would be staying.

The operator utilised two Cessna 172 aircraft for these flights: VH-JER (flown by the chief pilot) and VH-WTQ (flown by the operator’s other pilot). Each aircraft could carry a maximum of three passengers. Therefore, the operator planned for each of the pilots to conduct two flights from Agnes Water to Middle Island.

The accident involving VH-WTQ occurred on the first flight of the day. VH-WTQ departed first, with VH-JER departing a couple of minutes behind.

The operator’s passenger charter flights were conducted under visual flight rules (VFR). Weather conditions were fine and clear for the flight, and the pilots reported there was a south-easterly wind of about 10–15 kt. VH-WTQ had sufficient fuel on board for the flight.

The ATSB’s examination of the sequence of events during the flight was based on interview information and recorded data. In particular:

• Following the accident, the ATSB successfully recovered data from a global positioning system (GPS) unit on board VH-WTQ. This GPS data included recorded values of time, latitude, longitude and altitude, which updated every 6–10 seconds throughout the accident flight.
• The passenger in the front right seat recorded a video of the entire flight on a mobile phone. The file primarily included footage of the view outside the aircraft, but also included some footage of inside the aircraft, including occasional footage of cockpit instruments. For the purpose of the investigation, the video footage elapsed time was synchronised with the GPS data time.^[2]

Take-off, climb and cruise

The pilot of VH-WTQ commenced the take-off roll at Agnes Water to the north at 1030:06. The aircraft reached an altitude of about 1,000 ft AMSL at about 1032:50, and the pilot levelled off soon after.

Figure 1 shows the track of the aircraft for the whole flight, based on the GPS data.

Figure 1: VH-WTQ’s flight path between Agnes Water ALA and the accident location on Middle Island

The flight path was based on data downloaded from the GPS unit on the aircraft. The insert image shows the location of the accident on a map of Australia. 
Source: Google earth, modified by the ATSB.

The operator’s passenger charter flights to the beach ALA routinely included various manoeuvres while en route to provide some additional enjoyment for the passengers (see Manoeuvres during flights). Accordingly, while en route to Middle Island, the pilot of VH-WTQ conducted a series of manoeuvres including steep turns, steep climbs and descents and yawing^[3] the aircraft left and right. Recorded GPS and radar data indicated that, during these manoeuvres, the aircraft’s altitude ranged between about 600 ft and 1,000 ft.

Descent

At about 1036:15, the pilot commenced the descent. At this time the aircraft was positioned above the main beach on Middle Island at an altitude of about 750 ft, heading north (Figure 1).

The GPS and radar data indicated that, during the descent, the aircraft had a constant groundspeed of about 125 kt and an average descent rate of about 400 ft/min. Audio analysis of the video footage indicated that the engine/propeller speed was about 2,670 revolutions per minute (RPM).

Because the pilot of VH-WTQ was conducting the first of the operator’s flights of the day to Middle Island ALA, he was required by the operator to conduct an airborne inspection of the beach landing area to ensure the landing surface was suitable.

Due to the surface wind direction, the pilot intended to land on the beach heading to the south. Consistent with the operator’s normal practices, he planned to descend close to the beach and inspect the landing area while flying to the north, in a clean configuration (no flap) and at normal cruise speed. He then planned to climb to about 500 ft, conduct a turn around Bustard Head and come back to land to the south (see Review of airborne inspections at Middle Island ALA).

Figure 2 shows the last 36 seconds of recorded GPS data (represented by the red line). As indicated in the figure, at 1037:26, the aircraft was approaching the southern end of the landing area and still descending.

Figure 2: VH-WTQ’s flight path just prior to the accident

This image shows the altitude and position data from the last five recorded data points prior to impact. The red lines are direct connections between each recorded data point and do not represent the aircraft’s actual flight path between points. The landing area is based on reviewing the GPS data for many previous landings; most landings to the south would use the northern end of the area. The Google Earth image was taken in May 2016, and reflects conditions with a lower tide than at the time of the accident.

Source: Google earth, modified by the ATSB.

Engine power loss

The video footage indicated that, at 1037:34, the engine sustained a sudden power loss. At the time of the power loss, the aircraft was above the water and close to the beach abeam the landing area. The aircraft was at about 60 ft (see GPS information) and had a groundspeed of about 124 kt (about 230 km/h). Figure 3 provides a still image from the video footage of the view outside the aircraft at the time of the engine power loss.

Figure 3: A still image taken from the video footage at the time of engine power loss (1037:34)

The image shows Bustard Head in the background (to the north). The vertical, black areas are the propeller blades captured by the video footage.

Source: Queensland Police Service.

The pilot stated that, just prior to the power loss, he had pulled back the throttle slightly. He recalled that as soon as he did this the engine suddenly stopped, and he realised that there had been a total power loss. He later described the power loss as being similar to the mixture control being pulled back.

The pilot reported that, immediately following the power loss, he conducted checks of the aircraft’s systems to identify the reason for the problem. He stated he checked the master switch (ON), magnetos (selected to BOTH), fuel selector (selected to BOTH tanks) and mixture (full rich), and could not identify the problem. He said that he had his right hand on the throttle with full power selected.

The pilot stated that he had very limited time to make a decision about how to respond to the emergency situation. The aircraft was descending and the speed was decreasing, and he did not believe he had any suitable emergency landing options available ahead (within a narrow arc of his current heading). He thought that if he continued straight ahead the aircraft would end up in the channel between the landing area and Bustard Head (given his current position, aircraft configuration, airspeed and tailwind). He also believed that attempting to ditch in the water would involve a very high risk, and therefore he wanted to avoid a water landing.

Figure 4 shows the view of the remaining landing area at 1037:36, 2 seconds after the engine power loss. This shows an area of beach visible ahead, but does not show a further area of beach that was available for an emergency landing around a bend to the left (see Figure 2 and Beach available for an emergency landing north of the landing area).

Figure 4: A still image taken from the video footage 2 seconds after engine power loss (1037:36)

At the time this image was taken the phone camera was oriented to the left of the aircraft’s heading. The image shows an area of sand on Middle Island beach, just prior to a bend to the left with further beach beyond.

Source: Queensland Police Service.

The pilot recalled that, having decided that he wanted to avoid a water landing, he then looked for the best place on the beach to conduct an emergency landing. During this process he raised the aircraft’s nose to gain height and achieve the best glide speed (70 kt), and he decided the safest option was to turn left towards the beach (to a heading about 90º left of the aircraft’s current heading). He stated that his intention at that time was not to land on the beach but to simply get the aircraft to the beach.

The video footage showed that, at 1037:37, the aircraft commenced a slight turn to the right in a nose-high attitude (climbing), and at 1037:43 the aircraft commenced the left turn with a bank angle of about 30–40º back towards the beach (while still climbing).

During the left turn, at 1037:52, the stall warning started to sound intermittently. At about this time the aircraft also started descending. The pilot recalled that, as he approached the beach, he realised the aircraft may hit a large sand dune behind the beach. He therefore continued the left turn, using the rudder to swing the tail of the aircraft around, to avoid the sand dune.

At 1037:59, the aircraft collided with terrain. Based on the video footage, the indicated airspeed just prior to impact was about 60 kt (about 110 km/h) and the indicated descent rate was over 600 ft/min. The aircraft’s bank angle increased to about 60° just prior to impact, and the aircraft had a significant nose-down attitude. The location of the accident site is shown in Figure 2.

One of the rear-seat passengers was fatally injured and the other three occupants sustained serious injuries during the impact. The aircraft was destroyed. Figure 5 shows the aircraft wreckage (see also Wreckage and impact information).

Figure 5: Accident site, facing north-east with Bustard Head in the background

Source: ATSB.

Post-impact events

An employee at the camp site on Middle Island had conducted an inspection of the area of beach where arriving aircraft taxied and parked, and he had placed a marker on the beach to indicate the limit of the suitable taxiing area. He was waiting near the landing area together with a guest staying at the camp site when they observed VH-WTQ fly past and then soon after impact terrain. The employee told the guest to go to the camp site and call emergency services while he proceeded to the aircraft to provide assistance.

The chief pilot, flying VH-JER, was about 2 NM (4 km) behind VH-WTQ. He reported that he did not see the accident sequence or hear a MAYDAY^[4] call but observed the wreckage of VH-WTQ as he approached the landing area. He immediately contacted air traffic services and made a PAN PAN^[5] call to advise there had been an accident. He landed soon after at the beach ALA. Figure 6 shows the area around the accident site, as viewed from VH-JER immediately following the accident.

Figure 6: Accident site, as viewed from VH-JER

Source: Queensland Police Service.

Following the impact, the aircraft cabin was inverted, and the occupants were all held in place by their restraints. A significant amount of fuel was observed to be leaking from the aircraft’s fuel tanks. The camp site employee, the chief pilot and other first responders extracted the occupants and moved them away from the wreckage to provide first aid. One of the rear-seat passengers was unresponsive, so the first responders provided cardiopulmonary resuscitation (CPR) but she could not be revived. A subsequent post-mortem examination determined that her injuries were not survivable (see also Occupant injuries).

Emergency services arrived on the scene at about 1143.

__________

1. Eastern Standard Time (EST) is Coordinated Universal Time (UTC) + 10 hours.
2. The last recorded GPS data point occurred at 1037:56. This was estimated to have been about 3 seconds prior to impact. The take-off commenced at an elapsed time of 14 seconds on the video file and the impact occurred at an elapsed time of 8 minutes and 7 seconds.
3. Yawing: the motion of an aircraft about its vertical or normal axis.
4. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
5. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Context

Pilot information

Qualifications and experience

The pilot of the accident flight was issued with a Private Pilot (Aeroplane) Licence (PPL) in December 1978 and a Commercial Pilot (Aeroplane) Licence (CPL) in October 2008. His licence included a rating for single-engine aircraft under 5,700 kg maximum take-off weight (MTOW). He also had endorsements for manual propeller pitch control and retractable landing gear. The pilot did not hold a low-level flight rating or aerobatic flight activity endorsement.

The pilot had been employed on a casual basis by Wyndham Aviation for about 6 years, primarily conducting passenger charter flights from Agnes Water to Middle Island or the other beach aeroplane landing area (ALA) the operator regularly used (known as Aircraft Beach). Based on figures from his logbook, it was estimated that he had conducted over 1,100 flights from Agnes Water to a beach ALA, with many additional flights between the two beach ALAs.

Overall, the pilot had approximately 3,550 hours total flying experience. He had flown about 62 hours in the last 90 days, which included 35 hours in VH-WTQ conducting flights to and from the beach ALAs.

The pilot of the accident flight and the chief pilot both reported that the pilot of the accident flight normally flew VH-WTQ and the chief pilot normally flew VH-JER. A comparison of the pilot’s logbook and data downloaded from the GPS unit on board VH-WTQ indicated that the pilot conducted almost all of the flights in VH-WTQ during the period from 12 November 2016 to 10 January 2017.

Flight reviews and proficiency checks

To exercise the privileges of his licences and rating, the pilot was required to complete an aeroplane flight review (AFR) every 2 years with an approved instructor. The requirements of a flight review were met when the instructor conducting the review was satisfied the pilot had demonstrated competency for the applicable licences and ratings according to the Civil Aviation Safety Authority (CASA) Part 61 Manual of Standards (MOS). Flight instructors were responsible for designing appropriate content for a pilot’s flight review.

The pilot last completed an AFR on 22 August 2016. The AFR was conducted from Agnes Water ALA in a Beechcraft A36 Bonanza. The instructor recalled that the review covered the basics required for a flight review. He could not recall conducting any simulated engine failures after take-off or having any discussions about such an event (and this was not a formal requirement) ⁶. However, there was a simulated engine failure flown to a practice forced landing to a beach that was terminated with a go-around from about 200–300 ft.

The instructor who conducted the AFR was familiar with the type of activity undertaken by the operator. However, the AFR was not required to examine the pilot’s knowledge of the operator’s procedures or demonstrate competency in using those procedures, including the procedures for conducting a precautionary search and landing or an airborne inspection of a beach ALA.

Records supplied by the operator showed that the pilot had satisfactorily completed an annual emergency procedures proficiency check on 20 August 2016, which was valid until 20 August 2017 (see Training and checking).

Medical information and recent history

The pilot held a class 1 medical certificate, which was valid until 6 October 2017. The certificate included the restriction that reading correction be available when exercising the privileges of the licence, and the pilot was observed to be wearing spectacles in photographs taken just prior to and during the flight. No significant medical concerns were noted in the pilot’s recent aviation medical examinations, and he reported that he had no medical issues on the day of the accident.

The pilot reported that he was well rested and had been sleeping normally in the days prior to the accident flight. His last recorded flights prior to 10 January 2017 were on 2 January (0.8 hours flight time^[7]) and 4 January (1.2 hours flight time). These flights were conducted in VH-WTQ and mostly involved flights between Agnes Water and Middle Island or Aircraft Beach, with the other flight being a scenic flight over the Middle Island area.

Aircraft information

General information

The Cessna 172M is a four-seat, high-wing, all metal, unpressurised aircraft with a fixed landing gear. It has a single, reciprocating piston engine driving a fixed-pitch propeller. The Cessna 172 was certified to carry a maximum of four occupants.

VH-WTQ was manufactured in 1973 and acquired by Wyndham Aviation in October 2013. In 2015 the aircraft was fitted with wider than normal tyres to assist with beach operations.

Tables 1, 2 and 3 provide details of VH-WTQ’s airframe, engine and propeller. The total time in service (TTIS) and other times in the tables are based on the information in the aircraft’s current maintenance release^[8] and other maintenance documentation. A detailed review of the available information identified that the documented flight times were less than the ATSB’s estimated flight times, as indicated in the tables (see Airworthiness and maintenance). All flight times in the tables refer to the situation just prior to the accident flight, which involved about 0.1 flight hours prior to the accident.

Table 1: Aircraft information

Table 2: Engine information

Table 3: Propeller information

Airworthiness and maintenance

Relevant information regarding VH-WTQ’s airworthiness and maintenance history included the following:

• The aircraft had a current certificate of registration and certificate of airworthiness.
• The aircraft was maintained in accordance with CASA’s maintenance schedule 5^[10] and all airworthiness directives (ADs) applicable to the aircraft. Maintenance schedule 5 outlined requirements for daily inspections (conducted prior to the first flight of each day) and periodic inspections (conducted every 100 hours or 12 months, whichever came first).
• The chief pilot was the operator’s head of aircraft airworthiness and maintenance control (HAAMC) (see also Personnel).
• All scheduled and unscheduled maintenance (except daily inspections, oil and oil filter changes and other maintenance allowed to be conducted by pilots) was conducted by an external maintenance organisation.
• The engine was required to be overhauled every 2,000 flight hours. An overhauled engine was installed in the aircraft in January 2013.
• The last periodic inspection was conducted on 20 September 2016. Each periodic inspection included (among other things) an engine compression check, engine run and functional check, and inspections of the engine, oil system, ignition system, induction system and fuel system. The inspection of the fuel system included (among other things) draining and flushing the carburettor and removing and inspecting the fuel strainer.
• The aircraft’s maintenance documentation and worksheets were examined, and there were no ongoing or outstanding defects identified with the aircraft.
• There were no outstanding defects or inspections listed on the aircraft’s current maintenance release, issued on 20 September 2016.
• The chief pilot and the pilot of the accident flight both reported that they conducted a daily inspection of VH-WTQ prior to the first flight of a day on those days when the pilot of the accident flight was conducting flights.^[11] Neither pilot identified any problems with the aircraft prior to the accident flight.
• The pilot of the accident flight routinely flew VH-WTQ and had conducted most of the recent flights in the aircraft. He reported that there were no recent or ongoing problems with the aircraft, and that the engine performed well during the flight up until the time of the power loss.

The ATSB identified that it was very likely that the aircraft’s flight time documented on the aircraft’s last three maintenance releases underestimated the aircraft’s actual flight time (see Appendix A). More specifically:

• A comparison of the flight time recorded on the GPS unit with the flight time documented on the current maintenance release for the period 14 November 2016 to 4 January 2017 indicated that the maintenance release flight time underestimated the actual (GPS-based) flight time by 5.3 hours (or 28 per cent) during this period. The underestimation was associated with a number of discrepancies, including the flight time associated with many flights between Agnes Water and a beach ALA being slightly underestimated, short flights between the beach ALAs not being included, and some flights between Agnes Water and a beach ALA not being included.
• The aircraft was fitted with an hour meter that recorded the aircraft’s flight time. The operator documented the current hour meter readings on the aircraft’s maintenance release up until 29 May 2015.
• Based on an hour meter reading documented in maintenance worksheets on 12 November 2015, the flight time documented on the maintenance releases underestimated the actual flight time by 62.2 hours (or about 40 per cent) during the period from the periodic inspection on 1 May 2015 to the next periodic inspection on 12 November 2015.
• Based on the hour meter reading after the aircraft impacted terrain on 10 January 2017, the flight time documented on the maintenance releases underestimated the actual flight time by 34.3 hours (or about 20 per cent) during the period from the periodic inspection on 12 November 2015 to 10 January 2017.
• Overall, a comparison of the flight time obtained from hour meter readings and the flight time documented on the aircraft’s maintenance releases indicated that the maintenance release figures underestimated the flight time by 96.5 hours (or about 32 per cent) during the period from 1 May 2015 to 10 January 2017. During this period, 207.3 flight hours were documented whereas the ATSB estimated that 303.8 flight hours were conducted.
• The chief pilot reported that he normally entered the flight times on the maintenance releases. He advised that he was unaware that the flight hours documented on the maintenance releases underestimated the actual flight times.

Based on the aircraft’s estimated flight time, from 1 May 2015 until 10 January 2017 three periodic (100 hourly) inspections should have been conducted but only two periodic inspections were conducted. However, the last periodic inspection (20 September 2016) was conducted about 43.8 hours prior to the accident flight. Except for the periodic inspections and oil and oil filter changes (see below), no other scheduled maintenance requirements appeared to be affected by the underestimation of the aircraft’s flight time.

An examination of the aircraft’s recent maintenance releases identified some other anomalies. These included:

• Between periodic inspections, oil and oil filter changes were required. The requirement for the engine fitted to VH-WTQ was for an oil and oil filter change after 50 hours flight time or 4 months (whichever came first).^[12] On all VH-WTQ’s maintenance releases from 22 May 2014 until the time of the accident, part 1 of the maintenance release included a 50-hour requirement for the oil and oil filter change but the 4-month requirement was not stated. The maintenance organisation that conducted the periodic inspections and issued the maintenance releases advised the ATSB that it had not understood there was a 4-month requirement in addition to the 50-hour requirement.
• Given the time period between the periodic inspections in November 2015 and September 2016 (over 10 months), two oil and oil filter changes should have been conducted during this period, and both documented on the maintenance release.
• Between the second last periodic inspection on 12 November 2015 and the last periodic inspection on 20 September 2016, there was no annotation on the maintenance release to certify that an oil and oil filter change had been conducted. The aircraft continued to be flown after the specified TTIS.^[13] When asked in 2019, the chief pilot could not recall whether the oil and oil filter change was conducted, but he believed he would have done it as required by the required time (after 50 hours).
• The maintenance release issued on 22 May 2014 also had no annotation to certify that an oil and oil filter change had been conducted after 50 hours, whereas on the aircraft’s other maintenance releases (issued on 3 October 2013, 7 October 2014, 16 December 2014, 1 May 2015), the chief pilot had annotated the maintenance release to certify that the activity had been conducted.
• The maintenance release issued on 12 November 2015 listed two Cessna Special Inspection Documents (SIDs), requiring inspections to be completed by 31 December 2015. The SIDs related to inspections of seat rails and door posts. There was no annotation on the maintenance release to certify that these inspections were completed, and the aircraft continued to be flown after the specified date. The inspections were completed during the next periodic inspection (20 September 2016)
• There were multiple days on which flights were recorded on the aircraft’s GPS unit and/or the pilot of the accident flight had included flights in VH-WTQ in his logbook, but there was no certification on the maintenance release stating that a daily inspection or flights had been conducted (see Appendix A).
• The aircraft’s current maintenance release was not located in the aircraft. The chief pilot (and aircraft owner) advised that he kept the aircraft’s maintenance release in his possession.^[14]

Fuel system

The aircraft had two fuel tanks, one in each wing. The integral fuel tanks had a combined maximum capacity of 159 L (or 42 US gallons), with the maximum usable capacity being 144 L (38 US gallons).

Figure 7 provides an overview of the Cessna 172M’s fuel system. As indicated in the figure, fuel from each tank flows by gravity to the fuel selector valve. Depending on the setting of the valve, fuel from the left tank, right tank or both tanks flows through a fuel strainer, the carburettor and then to the engine. If the fuel selector is selected to BOTH and one of the tanks runs out of useable fuel, the engine will keep operating from the fuel flowing from the other tank. If the fuel selector is selected to OFF in flight, the engine will stop very soon after.^[15]

Figure 7: Overview of Cessna 172M’s fuel system

Source: Cessna.

The Cessna 172M Owner’s Manual stated:

The fuel selector valve should be in the BOTH position for take-off, climb, landing, and maneuvers that involve prolonged slips or skids. Operation from either LEFT or RIGHT tank is reserved for cruising flight.

The pilot of the accident flight reported that he always conducted the flights from Agnes Water to or from the beach ALAs with the fuel selector switched to BOTH for the whole flight.

The Owner’s Manual also included the following statement:

NOTE:
With low fuel (1/8th tank or less), a prolonged steep descent (1500 feet or more) with partial power, full flaps, and 80 MPH or greater should be avoided due to the possibility of the fuel tank outlets being uncovered, causing temporary fuel starvation. If starvation occurs, levelling the nose should restore power within 20 seconds.

Further information about the fuel quantity and fuel quality on VH-WTQ is provided in Fuel information.

Recorded information

Review of video footage

The video footage of the flight was taken using an iPhone 5S mobile phone. The Queensland Police Service (police) recovered the phone from the accident site and downloaded the video file.

The video footage provided continuous video and audio information throughout the entire flight. The footage primarily included views outside the aircraft, but also included some footage of inside the aircraft, including occasional footage of cockpit instruments. Where relevant, this information has been included in The occurrence and other sections of this report.

Table 4 provides a more detailed summary of events and observations following the engine power loss at 1037:34 based on the video footage.

Table 4: Summary of events and observations based on video footage after the engine power loss

At various times from 1037:48 until impact, some cockpit control settings were observed in the video footage. These included flaps selected UP, master switch ON, magnetos selected to BOTH, mixture full rich and carburettor heat off.

It should be noted that for some of the indicated altitudes the altimeter appeared to be over reading (see Appendix B). In addition, airspeed, altitude and descent rate indications may become less reliable in uncoordinated flight and indicated airspeed may become less reliable as the aircraft approaches a stall (see Stall speed).

Audio analysis of the engine/propeller speed

Audio analysis of the video footage was conducted to examine the engine/propeller speed throughout the flight.^[17] Key results were:

• during the take-off the engine/propeller speed increased to 1,610 revolutions per minute (RPM)
• during the climb the engine/propeller speed was about 2,480 RPM
• during the en route and manoeuvring phase the engine/propeller speed was about 2,670 RPM
• during the descent, up until the power loss, the engine/propeller speed was the same as during the cruise (about 2,670 RPM)
• at 1037:34, there was an initial rapid reduction of engine/propeller speed (over about 1 second) followed by a more gradual reduction for the remainder of the flight, with specific figures including:
• 2,680 RPM at 1037:33 (1 second prior to the power loss)
• 1,600 RPM at 1037:37 (3 seconds after the power loss)
• 770 RPM at 1037:56 (3 seconds prior to impact)
• 700 RPM just prior to impact.

The low values of RPM after the sudden power loss were consistent with the effect of the propeller windmilling in the airflow (rather than the propeller being driven by reduced engine power). As the airspeed decreased, the windmilling effect that drove the propeller decreased.

RPM values derived from the audio analysis were consistent with images of the RPM indicator present in the video footage in the 13 seconds prior to impact.

Prior to the sudden engine power loss at 1037:34, the only anomaly in the engine/propeller sound during the flight occurred at 1036:13, when there was a momentary reduction of engine/propeller speed before it recovered to its normal setting. This occurred during a rapid though brief pitch-down manoeuvre. The brief reduction in power appeared to be consistent with what would expected with the normal operation of the carburettor in such a manoeuvre and would have had no long-term effect.

This pitch-down was the last in a series on intentional manoeuvres, which also included rapidly pitching the aircraft down then up (three times) and quickly yawing from side to side (two times). The pilot reported that he thought the brief reduction in power was related to the manoeuvres rather than a problem with the engine or the aircraft. He stated that such reductions were not common but he had encountered them before in the same circumstances.

The ATSB received multiple reports from former passengers and/or residents in the area that the operator’s en route manoeuvres sometimes included a pilot briefly cutting the engine power. However, the chief pilot and the pilot of the accident flight both advised the ATSB that they had not conducted that practice.

GPS information

The global positioning system (GPS) unit on board VH-WTQ was a Garmin 296 Portable Aviation Receiver. The unit was hard-wired into the aircraft and connected to an antenna fitted to the aircraft. The chief pilot stated that, as far as he was aware, the unit was never removed from the aircraft and used in other aircraft.

The ATSB downloaded the available data from the unit using the manufacturer’s procedures and software. Data was successfully downloaded for the accident flight and numerous previous flights conducted between 12 November 2016^[18] and 4 January 2017.

The Garmin 296 GPS unit has a published accuracy of less than 15 m in both horizontal and vertical planes. In other words, most of the recorded data points will be within 15 m of the actual position in each plane. However, the manufacturer has advised the following in relation to accuracy:

• In steady flight the horizontal accuracy is closer to 5 m and the vertical accuracy is typically about 1.5 times the horizontal accuracy (that is, 7.5 m or 25 ft).
• The accuracy of the GPS data degrades if the aircraft is accelerating at the time. In other words, the data is less accurate if the aircraft is conducting steep turns or climbing or descending at changing rates. Nevertheless, even with 2 g acceleration, the accuracy would still be within 25 m.

The accuracy of GPS data is affected by the number of satellites visible and their positions, and with ionospheric conditions. The manufacturer’s stated accuracy takes such variations into account, although sometimes there may be unusual conditions where the GPS is less accurate than normal. Based on satellite positions and ionospheric conditions at the time of the accident, the manufacturer’s expected level of accuracy during steady flight should have been achieved.

There was no evidence available to indicate that the specific GPS unit fitted on VH-WTQ was less reliable than any other Garmin 296 unit. Examination of recorded position and altitude data was consistent with the location and elevation of take-off and landing areas for the accident flight and preceding flights. The pilot of the accident flight reported that the aircraft was at about 150–200 ft when he conducted the airborne inspection of the ALA and when the engine power loss occurred. However, the recorded GPS data indicated that the aircraft was at about 70 ft just prior to the power loss (Figure 2) and therefore at about 60 ft when the power loss occurred.

In addition, the pilot reported that the engine power loss occurred at about the position annotated with the time 1037:38 in Figure 2 rather than the position annotated by the time 1037:34. That is, he believed the power loss occurred about 240 m further north than indicated by the recorded GPS data (after calibrating this data with the video footage).

The ATSB conducted a detailed comparison of the GPS data with the video footage, radar data and other sources of information to determine the accuracy of the data. This comparison found that the recorded GPS data was within its expected level of accuracy during the descent and up until the time of the engine power loss. More specifically, the engine power loss occurred at close to the position indicated in Figure 2, while the aircraft was probably between 40 and 80 ft (and therefore probably close to the GPS-based altitude of 60 ft). This altitude was consistent with the GPS data from previous airborne inspections of the ALA flown by the pilot of the accident flight (Review of airborne inspections at Middle Island ALA).

Consistent with the known limitations of GPS data, the recorded GPS altitude data was less accurate earlier in the flight (during the cruise when manoeuvres were conducted) and during the climb and left turn following the engine power loss.

Details of the ATSB’s verification of the recorded GPS data are provided in Appendix B.

Radar data

A review of Airservices Australia recorded radar data showed a number of secondary radar returns^[19] that were confirmed to be from VH-WTQ. The radar data provided track and altitude information from 1032 until the accident. The radar data was consistent with that provided by the GPS data, although the altitude had a lower resolution (see Appendix B).

A review of the radar data also showed that another aircraft followed VH-WTQ, with a similar flight path. This aircraft had no associated altitude information, consistent with its transponder’s altitude encoder being unserviceable or turned off during the flight. The operator’s chief pilot was also flying to the same beach location, and was about 2 NM (4 km) behind VH-WTQ, in VH-JER. It was therefore concluded that the other radar returns were from VH-JER.

In 2019 the chief pilot recalled that VH-JER had a transponder failure at about the time of the accident. He identified the problem after 10 January 2017 during a flight conducted through controlled airspace.

Missing recording devices

During the early stages of the on-site investigation, the ATSB became aware that the two passengers who occupied the rear seats had GoPro video recording cameras on board the accident flight. One had a camera fitted with a yellow float handle and one had a camera fitted with a black handle.

During interviews with police officers, a witness stated that about 5 days prior to the flight he observed the owner of the GoPro camera with a black handle install a memory card into that GoPro camera. Furthermore, he recalled that on the morning of the accident flight the two rear- seat passengers stated they were both going to film the flight using their GoPro cameras. Photographs showed the passengers were holding their cameras just before boarding the aircraft, and a photograph of one of the passengers during the flight showed her still holding her camera.

Some photographs taken just after the accident showed a GoPro camera with a yellow float handle in front of the aircraft’s right wing. It was also reported by a first responder that another GoPro camera with a black handle was seen near the nose of the aircraft.

Given the high degree of potential importance as evidence, an extensive search of the accident site for the GoPro cameras was conducted by the ATSB, police and state emergency service volunteers. That search did not locate either of the missing cameras.

Several first responders were interviewed regarding any recording devices found at the accident site. The chief pilot initially provided the ATSB with one of the mobile phones recovered from the site, and other mobile phones were located either at the site or were provided by other first responders to the police. Subsequently, the chief pilot recalled that he had been given a GoPro camera at the accident site, and he advised one of the rear-seat passengers’ friends that he had the camera but it had no memory card in it. The police took possession of the camera from the chief pilot and confirmed there was no SD memory card installed. The camera was in a good condition and was clamped down in a handle cradle and had an access door to the memory card slot closed and secured by a latch.

The reason why there was no memory card in the black-handled GoPro camera could not be determined, and the yellow-handled camera was never located.

Wreckage and impact information

Impact information

The accident site was located above the high tide line on a beach on Middle Island, 12 NM north-west of Agnes Water. A photograph taken by a first responder shortly after the accident showed that the left wingtip had scraped on the beach prior to the aircraft nose impact point (Figure 8). The impact marks were subsequently removed by the next high tide, which occurred before the arrival of ATSB investigators the next day.

The distance between the nose impact point and the main wreckage was about 5 m on a magnetic bearing of 210⁰. The wreckage distribution and distance from the impact point indicated that the aircraft impacted terrain in a significant nose-down and left-wing low attitude. The aircraft came to rest facing in the opposite direction to flight.

Figure 8: VH-WTQ accident site showing impact marks

This image also shows the sand dunes behind the beach, in the direction where the aircraft was headed prior to impact.

Source: Wyndham Aviation chief pilot.

Aircraft structure

The aircraft was significantly disrupted by ground impact forces. The main fuselage structure had fractured at the rear of the engine firewall and just aft of the rear passenger seats. The cabin area was twisted and compressed and both wings had separated from the fuselage structure at the wing root (Figure 9).

The aircraft structure was examined for pre-impact defects, with none identified. All of the aircraft and its components were accounted for at the accident site. There was no indication of any fire.

Figure 9: VH-WTQ aircraft wreckage viewed from the right

Source: ATSB.

Flight controls and cockpit switches and controls

All of the flight control systems were examined from the cockpit through to the control surfaces, and no pre-impact defects were identified. The flap actuator was examined and the flap positon was determined to be in the fully UP position. The elevator trim was in full nose-down position; however, that was not considered to be an accurate reflection of the position set before impact due to wreckage disruption and distortion.

The cockpit was examined to ascertain switch, flight control and engine settings. The following positions were noted:

• throttle was in the full power position
• mixture was in the full rich position
• carburettor heat was fully closed (off)
• fuel tank selector was in the BOTH position
• master switch was OFF (consistent with it being switched off by the first responders to the accident)
• magnetos were in the OFF position (consistent with them being switched off by the first responders to the accident).

Fuel system examination

Examination of the fuel system identified the following:

• Both the left and right fuel tank caps were in place and secured. The caps had ventilation holes to prevent negative pressure in the fuel tanks.
• The fuel feed and ventilation lines were inspected, with no defects noted.
• Both fuel tanks were damaged during the accident sequence and fuel subsequently leaked into sand in the surrounding area. A small amount of fuel remained in both tanks. A sample of the fuel was drained into a purpose-made fuel storage container. The fuel appeared to be clean with no evidence of foreign particles and it had a smell and colour consistent with 100 LL (low lead) aviation fuel. The sample was subsequently sent for laboratory testing (see Fuel quality).
• The fuel strainer bowl located on the engine firewall was examined externally for damage. The outlet line to the engine had fractured at the base of its thread as it entered the bowl housing. That fracture was examined and determined to be caused by ductile overload due to impact forces.
• The fuel strainer bowl was removed from its housing to determine the amount and quality of fuel that was retained. A clean and dry container was utilised to capture the fuel that came out of the bowl when it was removed. About 80 mL of fuel was drained from the bowl and examined. The fuel had a cloudy appearance and had a section of what appeared to be water and debris in the bottom 20 mL of the sample. Water finding paste was utilised and came back with a positive test for water in the fuel strainer bowl sample (Figure 10).
• The fuel strainer filter was removed and examined. A small amount of debris was found in the inlet side of the filter. The amount and type of debris was not considered to be excessive or abnormal.

Figure 10: Fuel strainer bowl and contents showing signs of water and debris

Source: ATSB.

Carburettor examination

The carburettor was examined in order to inspect the fuel inlet finger filter, throttle and mixture controls (in full power and mixture rich position) and air intake filter and by-pass. No pre-impact issues were identified (Figure 11).

Figure 11: Carburettor and air intake assembly

Source: ATSB.

The carburettor was oriented about 80° on its right side with the fuel inlet facing upwards. It was removed from the engine and inspected, with no defects noted.

As part of the removal process, care was taken not to invert the carburettor so as to prevent fuel draining out of the unit. With the carburettor in an upright position, the carburettor bowl drain was removed in order to ascertain if any fuel remained in the unit (Figure 12). No fluid of any kind was drained from the unit. It is possible that some fuel had leaked out of the unit while it was on its side; however, the orientation of the unit meant that some fuel should have remained in the carburettor bowl.

Figure 12: Carburettor showing drain point located at its base

Source: ATSB.

Engine examination

The engine was removed from the aircraft and taken to a certified overhaul facility where it was disassembled and examined under the supervision of the ATSB. Key results from the examination included:

• No pre-accident defects were identified with the mechanical components of the engine.
• The carburettor was disassembled and inspected, with no faults identified. There were no foreign particles and debris, apart from a small amount of rust-like residue at the drain point reservoir (Figure 13). The fuel metering orifice was also clean and free of foreign particles and debris. Given that no actual particles or debris were found in the carburettor, the presence of this rust-like residue was very unlikely to have contributed to the engine power loss.
• The magnetos were checked for correct timing and then removed for functional testing. Both magnetos functioned as designed with no faults identified.
• All the spark plugs were removed from the engine, inspected and tested. No faults were identified.

The exhaust system fitted to VH-WTQ at the time of the accident was an aftermarket, tuned exhaust system. The system was different from the standard exhaust in that it did not have a muffler to attenuate noise but rather had four exhaust tubes feeding into one manifold tube. The exhaust was removed from the engine and inspected in the inlet and outlets for obstruction, with no obstructions detected. The exhaust was also shaken in order to ascertain if there were loose items internal to the exhaust; there was no audible sound of loose items in the exhaust system.

Figure 13: Disassembled carburettor showing internal components

Source: ATSB.

The propeller was examined on site for evidence of correct and secure fitment, with no issues identified. The propeller blades were examined for evidence of rotation damage at the point of impact. Only minor abrasion damage was observed on the blades with no other indications of rotation (Figure 14). That damage was consistent with very low or no power being delivered by the engine at impact.

Figure 14: Propeller blades showing slight paint abrasion damage

Source: ATSB.

Re-examination of the aircraft

Following inspection and testing of several components and analysis of the available evidence, the ATSB conducted a re-examination of the aircraft wreckage in May 2017, with a particular focus on the fuel storage, fuel ventilation and the airframe side of the engine ignition system. This included an examination of the fuel tanks and a re-examination of the fuel caps, with a test of both caps indicating they were capable of providing ventilation to the tanks. The re-examination did not identify any notable defects within the airframe fuel and ignition systems that may have contributed to the engine power loss.

The fuel selector was removed from the aircraft for detailed examination and testing. The fuel selector was subsequently X-rayed in order to examine the internal components without disturbing any possible defects. The X-ray showed that the selector was in the BOTH position with the left and right fuel inlet ports in the OPEN position. Further, there was no apparent damage to the internal components. A functional test of the selector was conducted by applying fluid to both sides of the inlet ports individually and together. That test showed that the fluid flowed freely through the outlet as designed on all occasions.

The ignition switch was removed from the aircraft for detailed examination and testing. The switch was X-rayed so that an internal inspection of the working components could be conducted without disturbing the internal components. There were no defects identified in the internal components of the switch. The switch was disassembled and inspected with no evidence of internal arcing or defects identified. A resistance test was conducted on the internal poles, with no defects identified.

Following a query from the chief pilot, the ATSB conducted a more detailed examination of the exhaust system. Each of the exhaust components was examined externally and internally. The heater shroud was removed from the exhaust mixer and the tubes were inspected externally with no defects identified. Each exhaust system component was examined internally utilising a borescope fitted with a camera. Viewing access was gained to all parts of each exhaust component. No obstructions or pre-impact defects were identified.

Fuel information

Fuel quantity

The examination of the wreckage could not provide an accurate estimate of the amount of fuel on board the aircraft at impact due to the extent and nature of the damage.

The ATSB reviewed the available information from the video footage, interviews and other sources to determine the best estimate of the fuel on board the aircraft at the time of the engine power loss (1037:34). The following information was considered:

• According to the aircraft’s maintenance schedule, VH-WTQ’s fuel quantity gauges were required to be calibrated every 4 years. They were last calibrated on 1 May 2015. The calibration card located in the aircraft indicated that the left and right gauges provided similar indications of the amount of useable fuel in each tank.^[20]
• The video footage taken during the accident flight showed the aircraft’s fuel quantity gauges on multiple occasions. During the period immediately prior to the engine power loss, the indicated fuel quantity was about one quarter full on the left tank gauge and slightly above half full on the right tank gauge.^[21] This equated to a useable fuel load of about 80 L.^[22]
• There was no record on the aircraft’s maintenance release to indicate that either of the fuel quantity gauges was indicating incorrectly. Both the chief pilot and the pilot of the accident flight stated that the fuel gauges on a Cessna 172 aircraft were not very accurate, but they did not recall any specific problems associated with the gauges on VH-WTQ.
• With regard to normal fuel loads and fuel burns:
• The operator’s Operations Manual stated that each flight was to carry 45 minutes fixed fuel reserve, with no variable reserve required for short flights (within 30 NM of the departure aerodrome). The manual also stated that a block flight planning fuel burn of 42 L/hour was to be used for short flights.
• The chief pilot reported that the operator’s fixed reserve for a Cessna 172 had been calculated to be 27 L.^[23] He also said that he did not like operating the aircraft such that the fuel remaining was close to the fixed reserve.
• The chief pilot and the pilot of the accident flight both reported that flights from Agnes Water to one of the beach ALAs and return used about 13 L. This equated to a total flight time of about 19 minutes for the two flights (based on a fuel burn of 42 L/hour).^[24]
• The chief pilot stated that he and the pilot of the accident flight generally used pre-calculated load and trim sheets when conducting flights between Agnes Water and a beach ALA. The most commonly used sheets were sheet 9 (with 66 L of fuel, sufficient for three trips), sheet 10 (with 53 L of fuel, sufficient for two trips) and sheet 11 (with 40 L of fuel, sufficient for one trip).
• The chief pilot reported that, depending on the number of trips flown during the day and the fuel remaining, they would often refuel the aircraft at the end of the day to a standard fuel load for two trips (53 L).
• The aircraft was normally refuelled from a fuel storage tank at Agnes Water ALA (Figure 15). The fuel storage tank was not fitted with a meter to accurately measure the amount of fuel dispensed when refuelling an aircraft. However, the chief pilot and the pilot of the accident flight stated that 25 turns of the handle produced about 20 L. After refuelling an aircraft, the amount of fuel on board would be checked using a calibrated dipstick.
• The pilot of the accident flight stated there was about 53 L (38 kg) of fuel on board at the time of his pre-flight inspection, as per the pre-calculated load and trim sheet 10; sufficient fuel for two trips. However, he initially could not recall if he added additional fuel prior to the flight; he vaguely recalled adding an additional amount of about 20 L but was not sure. He also stated that if he knew he was conducting two trips on the same day (as he did on the day of the accident) he would normally ensure he had enough fuel on board for three trips (outbound and inbound) at the beginning of the day in case there was a requirement to transport additional passengers.^[25] The pilot of the accident flight subsequently advised that he did not recall refuelling the aircraft on the day of the accident, but had checked the fuel quantity prior to flight using the dipstick and there was 53 L on board.
• The operator’s Operations Manual required a pilot to complete a trip log for the day’s flights conducted in an aircraft. The log required the fuel remaining at the end of a trip, the fuel added, the fuel on board at the start of each trip and the flight time to be recorded. The ATSB did not obtain the trip logs for VH-WTQ after the accident, and the chief pilot was not able to provide the logs when they were requested in 2019. The pilot of the accident flight recalled that he did not complete trip logs, but provided relevant figures to the chief pilot who completed the logs.

In summary, the aircraft’s fuel gauges indicated there was about 80 L of fuel on board during the flight, and therefore a slightly higher figure prior to take-off. The pilot of the accident flight stated that, consistent with the pre-calculated load and trim sheet 10, there would have been 53 L on board at take-off. Overall, the ATSB concluded there was probably more than 53 L on board prior to departure, and potentially up to about 80 L, but the exact amount could not be determined.

Fuel quality

The fuel storage tank at Agnes Water ALA (Figure 15) was utilised by both of the operator’s Cessna 172 aircraft, with the same batch of fuel being used in the period leading up to the day of the accident without any problems being noted.

Figure 15: Fuel storage tank containing aviation grade gasoline

Source: ATSB.

The chief pilot stated that the fuel in the storage tank was checked visually for quality and the presence of water prior to each aircraft refuel. When the fuel storage tank was empty it was taken to Bundaberg Aerodrome and refuelled with 100LL aviation grade gasoline.

On 2 February 2017, inspectors from the Civil Aviation Safety Authority (CASA) conducted an on-site inspection of the operator’s facilities. During this inspection, the chief pilot demonstrated an inspection of the fuel in the storage tank, and no problems were identified.

The chief pilot stated that on the morning of the accident flight he performed a pre-flight inspection of VH-WTQ, which included a water drain check of each of the aircraft’s three fuel drains. He then signed the daily inspection on the aircraft’s maintenance release. The chief pilot stated that he was not present at the time the pilot of the accident flight performed his own pre-flight inspection of VH-WTQ.

The pilot of the accident flight stated that, regardless of whether the chief pilot had conducted a pre-flight inspection, he always conducted his own inspection, including water drain checks. He did not identify any water or other problems with the fuel prior to the accident flight.

As noted in Fuel system examination, a small sample (about 1 L) of fuel was decanted by the ATSB into a purpose-made fuel storage container from the fuel remaining in the wing tanks. That sample was sent to a chemical test facility. The fuel sample test report stated that, apart from high tetra ethyl lead content, the fuel test point specifications fell within the normal limits for 100LL aviation gasoline.

Excessive tetra ethyl lead content can lead to fouling of the spark plugs and build-up of residue on piston heads. The ATSB’s examination of the spark plugs and piston heads during the engine disassembly did not identify any issues due to excessive build-up of residue in relation to lead content.

Weight and balance information

Aircraft loading requirements

Civil Aviation Regulation (CAR) 235 (Take-off and landing of aircraft etc) stated that a pilot in command must not allow an aircraft to take off if its gross weight exceeded its maximum take-off weight (MTOW),^[26] and that the load of the aircraft should be distributed so that the centre of gravity of the aircraft was within the limitations specified in the aircraft’s flight manual.

Civil Aviation Advisory Publication (CAAP) 235-1(1) (Standard Passenger and Baggage Weights) provided advisory information about methods to use for determining passenger and baggage weights. It recommended:

Because the probability of overloading a small aircraft is high if standard weights are used, the use of standard weights in aircraft with less than seven seats is inadvisable. Load calculations for these aircraft should be made using actual weights arrived at by weighing all occupants and baggage.

The Operations Manual stated:

Load calculations for all Company aircraft are to be made using actual weights for all passengers and baggage.

The operator used a series of pre-calculated load and trim sheets for its passenger charter flights. The Operations Manual stated that, when using these sheets, the pilot in command must ensure that actual passenger weights were not greater than the weights specified in the sheet being used.

The operator had scales available at Agnes Water to weigh passengers and baggage. The chief pilot advised the ATSB that he and the pilot of the accident flight were experienced at estimating the weights of passengers (by visual inspection) and baggage (by visual inspection and handling the items). They only weighed them if they appeared to be close to or exceed the weights specified in the selected pre-calculated load and trim sheet. He also advised that he and the pilot of the accident flight did not always complete a specific load sheet for each flight by annotating actual (estimated or measured) weights to the standard load and trim sheet; rather they just accepted the standard weights as being applicable.

During an audit of the operator in March 2015, CASA made a finding (observation) that the operator used a standardised loading system for determining aircraft take-off weights that did not include the use of the actual weights of passengers and cargo (see Schedule site inspection in 2015). In response, in May 2015 the chief pilot advised CASA in writing that the operator would weigh all passengers and baggage on future flights. The pilot of the accident flight advised the ATSB that he was not made aware of the CASA finding and the chief pilot’s response, and had he been advised to weigh all passengers and cargo he would have done so.

Pre-calculated load and trim sheet data

The current weight and balance certificate for VH-WTQ was issued on 20 November 2014, following the fitment of an approved landing gear modification. The aircraft’s basic empty weight was recalculated as 679.1 kg (an increase of 22.1 kg from the previous weight of 657 kg). The MTOW was 1,043 kg (2,300 lb).

On 13 January 2017, the chief pilot provided the ATSB with a version of pre-calculated load and trim sheet 10. At that time he stated it was the sheet used for the weight and balance for VH-WTQ on the morning of the accident flight. This version of sheet 10 used the aircraft’s previous basic empty weight (657 kg). It also had figures of 38.2 kg (53 L) for fuel, 88 kg for the pilot, 77 kg for each passenger and 22 kg for baggage. Soon after, the chief pilot provided CASA with a copy of sheet 9, and this document also included a basic empty weight of 657 kg.

Subsequently, in early November 2018, the chief pilot provided the ATSB with a second version of sheet 10. It had the same fuel load as the previous version (53 L) with a slightly modified weight (37.6 kg), but had the correct aircraft basic empty weight (679.1 kg). It also had modified figures for the pilot (85 kg), each passenger (70 kg) and baggage (22 kg).

In mid-November 2018, the chief pilot provided a third version of sheet 10, and stated it was the version used by the pilot of the accident flight on the day of the accident. It had the same fuel weight, basic empty weight and pilot weight as the second version, but had different figures for each passenger (65 kg) and baggage (48 kg).

The chief pilot could not explain why the initial sheets provided to the ATSB and CASA had an incorrect aircraft basic empty weight.^[27] For the purpose of the investigation, the ATSB considered the third version of sheet 10 provided by the chief pilot (see Aircraft load on the accident flight).

As noted above, CAAP 235-1(1) stated that standard passenger weights should not be used for aircraft with less than seven seats. It also stated that the use of the same standard weight for all types of aircraft with seven seats or more was inappropriate, because the probability of overloading increases as the capacity of the aircraft decreases. More specifically:

For example, when a standard weight of 77 kg is used in a 12 passenger aircraft instead of actual weights, the statistical probability of overloading the aircraft is as high as 25%. This probability diminishes to 0.0014% if the same standard weight of 77 kg is used on a very large capacity aircraft, such as a 400 passenger Boeing 747.

The CAAP, issued in 1990, suggested weights for an aircraft with 7–9 seats of 86 kg for an adult male, 71 kg for an adult female, 65 kg for an adolescent male and 58 kg for an adolescent female. As the size of the aircraft increased, slightly lighter weights were suggested. For the largest aircraft, weights of 81, 66, 61 and 55 kg were suggested for the four categories of passenger.

The average weight of people has increased over the years. Recent figures from the Australian Bureau of Statistics noted that in 2011–12 the average weight of an Australian male was 86 kg and the average weight of an Australian female was 71 kg, with both increasing about 4 kg since 1995.

Aircraft load on the accident flight

In addition to three passengers, VH-WTQ was loaded with the passengers’ baggage and various camping supplies. One of the passengers on board the operator’s other aircraft (VH-JER) also stated that his baggage was on board VH-WTQ.

Both the chief pilot and the pilot of the accident flight advised the ATSB that, in their opinion, VH‑WTQ was significantly below its MTOW prior to its departure on 10 January 2017. Neither the chief pilot, nor the pilot of the accident flight, used scales to verify the actual passenger weights or the weights of the baggage and supplies loaded on board VH-WTQ. Passengers on board VH‑WTQ and VH-JER did not recall being weighed, being asked for their actual weights or having their baggage weighed.

The copy of sheet 10 that was provided to the ATSB in mid-November 2018 had annotations regarding passenger and baggage weights specific to the accident flight, and it was signed by the pilot of the accident flight. He subsequently advised the ATSB that the sheet had been in his private vehicle, which is why it had not been identified during the on-site investigation. The annotated figures on the sheet indicated that the aircraft’s weight was 1,027.7 kg, or about 15 kg below the MTOW.

During the on-site investigation, the ATSB recovered personal baggage and camping equipment from the baggage compartment of VH-WTQ. The ATSB also recovered camp food and drink supplies from the baggage compartment, as well as some of these supplies from the aircraft cabin and a small number of similar items from the surrounding area that were potentially on board the aircraft (Figure 16). The majority of the items were weighed by the police. For some other items not weighed by the police, including camp food supplies and a 10 L water container, the ATSB used weights provided by and agreed to in writing by the chief pilot. The total weight of all items recovered from the aircraft, or known to be on the aircraft at the time of the accident, was calculated to be 42.4 kg. This was considered to be an underestimate, as some other additional food and drink items close to the wreckage may also have been on board.

Figure 16: Some of the contents from VH-WTQ’s baggage compartment at the accident site

Some other items recovered by the ATSB from the wreckage are not included in this photograph. Those included cans of alcohol. It was reported that a full carton of rum and cola drink was on board but only 18 cans were recovered and included in the baggage weight. A large (3 kg) pumpkin was found close to the wreckage but not included in the final calculation. Only one of the 1.5 L water bottles shown in the photograph was included in the ATSB weight calculation (although others were found nearby and were potentially on board). The rubber mat was also not included in the ATSB calculations.

Source: ATSB.

The ATSB obtained the weight of the left rear-seat passenger from the post-mortem report and the right rear-seat passenger from that passenger. The ATSB used the weights of the pilot and the front-seat passenger that the pilot of the accident flight had annotated on his load and trim sheet. The annotated weight for the pilot matched the weight documented in his recent aviation medical examinations.

Table 5 provides a comparison of weights from the operator’s revised pre-calculated load and trim sheet 10, the pilot’s annotated load and trim sheet and the ATSB’s estimates. As indicated in the table, the ATSB estimated that the aircraft’s weight was at least 1,060 kg, or at least 17 kg above the MTOW (rounded to the nearest kg). This was considered to be a conservative estimate, as the fuel load could have been more than 53 L (see Fuel information) and the baggage / camp supplies weight may have been higher than 42 kg.

As indicated in the table, both the baggage / camp supplies weight and the passenger weights were higher than estimated by the pilot of the accident flight. The chief pilot was present at the time the aircraft was being loaded, and he provided similar estimates of the passenger and baggage weights as the pilot of the accident flight.

Table 5: Comparison of loading data for VH-WTQ between operator load and trim sheet weights and actual weights (rounded to the nearest 1 kg except where stated)

Aircraft load on VH-JER

The operator’s other Cessna 172 aircraft, VH-JER, was reweighed in February 2015 and had a basic empty weight of 722 kg. Due to approved modifications associated with the aircraft’s flaps, it had a maximum MTOW of 1,089 kg (2,400 lb).

On the morning of the accident flight, VH-JER departed with the chief pilot, two adult male passengers and one adult female passenger on board. One of the male passengers reported that he was 110–115 kg. The chief pilot’s weight documented during a recent aviation medical examination was 92 kg. The aircraft was also loaded with two of the passengers’ baggage and some camping supplies. A photograph taken prior to the flight and video footage taken during the flight showed that multiple items of baggage were loaded on the aircraft.

The ATSB did not obtain copies of the pre-calculated load and trim sheets for VH-JER, or of any load sheet used for the flight. However, the ATSB estimated the aircraft’s take-off weight as being 1,110 kg based on the following:

• basic empty weight: 722 kg
• weight of pilot and passengers: 359 kg (based on 92 kg for the pilot, 110 kg for one male passenger, and average passenger weights of 86 kg for the other male passenger and 71 kg for the female passenger)
• minimum fuel load for one trip: 29 kg (40 L).

Based on this estimate, VH-JER was 21 kg above the MTOW of 1,089 kg for its first flight on 10 January 2017. Although it is possible that two of the passengers may have been less than the average weights, it should be noted that the ATSB estimate did not include any baggage / cargo, and the fuel load was probably more than 40 L (given that the aircraft was normally refuelled to a standard fuel load of 53 L for two trips).

Aircraft balance and centre of gravity

Aircraft balance refers to the location of the centre of gravity, along the longitudinal and lateral axis. In order to assure predictable aircraft control, the aircraft manufacturer established limitations along the longitudinal axis at fuselage stations measured in inches (in), in relation to a reference point or datum (located at the forward face of the engine compartment firewall).

The centre of gravity limitation for operation of VH-WTQ in the normal category at the MTOW of 1,043 kg (2,300 lb) was a forward limit of 977.9 mm (38.5 in) aft of the datum and rearward limit of 1,201 mm (47.3 in) aft of the datum.

ATSB calculations indicated that the aircraft’s centre of gravity was inside of the allowable aft centre of gravity envelope, regardless of whether the fuel load was 53 L (38 kg) or up to 80 L (58 kg).

Unrestrained cargo

Civil Aviation Order (CAO) 20.16.2 (Air Service Operations – Loading) contained requirements to secure cargo loaded on board an aircraft. The operator’s Operations Manual required the pilot in command to ensure all cargo was ‘properly restrained by the appropriate use of ropes, tie-down straps and/or cargo nets’. The manual also stated:

All cargo carried shall be restrained in a manner which prevents any article from moving under the maximum accelerations to be expected in flight or in the event of an emergency landing or ditching.

During the ATSB on-site investigation, no cargo restraint, net, or barrier was observed in the wreckage and all of the baggage/camp supplies was unsecured. The chief pilot and the pilot of the accident flight confirmed that they did not use cargo nets or similar means to restrain cargo in any of the operator’s aircraft.

Aircraft performance

Stall speed

An aerodynamic stall occurs when the wing’s angle of attack exceeds the critical angle at which the smooth airflow begins to separate from the wing. When a wing stalls, the airflow breaks away from the upper surface, and the amount of lift is reduced to below that needed to support the aircraft.

The speed at which a stall occurs is related to the load factor of the manoeuvre being performed. Load factor increases with the application of nose-up elevator, such as to maintain altitude in a turn, and therefore the level-flight stall speed will also increase with bank angle. An aircraft’s centre of gravity can also influence stall characteristics.

The level-flight stall speeds for the Cessna 172M were contained within the aircraft’s Owner’s Manual (Figure 17). Below these speeds, the aircraft would not be able to maintain altitude. The stall speed guidance was based on the aircraft’s maximum take-off weight (1,043 kg or 2,300 lbs) with the engine power at idle RPM. The stall speeds quoted in the figure are in miles per hour (mph). They were also stated for calibrated airspeed, as indicated airspeeds become less reliable near a stall.

Figure 17: C172M stall speed data

The stall speeds are stated in mph rather than kt, and they are also stated for calibrated airspeed rather than indicated airspeed.

Source: Cessna.

In the context of the VH-WTQ accident, the aircraft’s bank angle during most of the final turn to the left was about 30-40⁰ (see Table 4), and the flaps were selected UP. Therefore, during most of the turn the level-flight stall speed was calculated to be about 61–65 mph (53–56 kt). Just prior to impact, when the bank angle increased to about 60°, the level-flight stall speed was about 81 mph (70 kt). When below these speeds, applying enough nose-up elevator to maintain altitude would cause the aircraft to stall.

If full flap had been selected, the stall speeds would have been reduced by about 10 mph (9 kt) for the same bank angle.

The Cessna 172 Owner’s Manual stated that the aircraft’s stall characteristics were ‘conventional’ and that an aural warning was provided by a stall warning horn, which sounded between 5‑10 mph (4–9 kt) above the stall in all configurations.

As noted in The occurrence, the aural stall warning first sounded at 1037:52 and then sounded intermittently for most of the following 7 seconds until impact. Based on the available information, the aircraft’s stall warning appeared to operate as designed.

Given the stall warning was intermittently sounding for the last 7 seconds, and the indicated airspeed decreased from 65 kt to 60 kt, it is very likely that the aircraft was close to the stall speed during this period. In the last 1–2 seconds, as the bank angle increased to about 60° and the indicated airspeed was about 60 kt, the aircraft may have entered the stall. The pilot’s use of left rudder in this period increased the potential to stall.

Landing distance

The Cessna 172M Owner’s Handbook stated that the landing distance at maximum weight on a hard, dry runway at sea level with no wind and using full flap was 1,250 ft (381 m). This included the distance from 50 ft above ground level (AGL) until the end of the landing roll. The landing roll under the same conditions was 520 ft (159 m).

The landing distance would be longer if the aircraft had a higher groundspeed or no flap was selected. In addition, the landing distance would be shorter if the aircraft encountered soft sand during the landing roll.

Meteorological information

General information

At about the time of the accident, Bureau of Meteorology weather observations recorded at Seventeen Seventy (10 NM south-east of the accident site) were an easterly wind at 9 kt and a temperature of 29 °C. The recorded dewpoint was calculated as being 23.6 °C.

The chief pilot, who landed at Middle Island ALA shortly after the accident, stated the wind was a south-easterly wind between 10 kt and 15 kt. Two witnesses on the ground at the beach ALA who were associated with the charter operation reported that the weather conditions at the time were fine with a light sea breeze.

A video recording of the entire accident flight also provided evidence that weather conditions such as visibility and turbulence did not contribute to the accident.

Carburettor icing

Carburettor icing occurs as a result of vaporisation of fuel and a reduction in pressure as the fuel/air mixture passes through the venturi in the carburettor. These effects cause a drop in temperature which, if it falls below the dew or freezing point of water, will result in ice forming on the sidewalls and the butterfly valve in the carburettor. As the ice builds up, it gradually blocks the venturi and alters the fuel/air balance, which causes the engine to run roughly and lose power.

Given a temperature of 29 °C and a dew point of 23.6 °C, there was only a ‘light’ risk of carburettor icing at cruise power settings.

The Cessna 172 Owner’s Manual stated:

Carburetor ice, as evidenced by an unexplained drop in RPM, can be removed by application of full carburetor heat...

Take-off is made normally with carburetor heat off…

Carburetor heat may be used to overcome any occasional engine roughness due to ice…

A gradual loss of RPM and eventual engine roughness may result from the formation of carburetor ice.

Audio analysis of the video footage did not identify any evidence of a loss of RPM or engine rough running during the descent and airborne inspection prior to the power loss (see Audio analysis of the engine/propeller speed).

The flight time up until the accident was only about 7 minutes in duration. The pilot reported that he had not selected (or needed to select) carburettor heat at any point during the flight.

Tide times

The tide chart for 10 January 2017 at Clews Point (about 3 NM north-west of the accident site) indicated that the last high tide was 3.24 m at 0642 with a low tide of 0.44 m at 1306. The approximate time of the accident was 1038 (about 4 hours after high tide and 2.5 hours before low tide). Therefore the tide height at Clews Point at the time of the accident was about 1.5 m with an outgoing tide.

Aeroplane landing area information

General information about landing areas

An aeroplane landing area (ALA) is an area of ground suitable for the conduct of take-off and landing and associated aeroplane operations under specific conditions. It is not authorised as an ‘aerodrome’ but can be used for aircraft involved in private, aerial work, or charter operations. They are not recommended for aircraft with a MTOW of more than 5,700 kg.

Under Civil Aviation Regulation (CAR) 92 (Use of aerodromes), aircraft may land at a ‘place’ other than an aerodrome if it:

…is suitable for use as an aerodrome for the purposes of the landing and taking-off of aircraft; and, having regard to all the circumstances of the proposed landing or take-off (including the prevailing weather conditions), the aircraft can land at, or take-off from, the place in safety.

Civil Aviation Advisory Publication (CAAP) 92-1(1) (Guidelines for aeroplane landing areas) provided guidance regarding the suitability of landing areas. The CAAP discussed factors such as runway width, runway length, longitudinal and transverse slopes, marking, lighting, runway surface and geographic location.

Civil Aviation Order (CAO) 82.1 (Conditions on Air Operator’s Certificates authorising charter operations and aerial work operations) stated that a charter operator was required to provide various types of documentation, including:

…a catalogue of authorised landing and alighting areas where operations are frequently conducted showing, in diagrammatic form, location by co-ordinates or in reference to prominent geographic features or nearest navigation aid, direction of runways, length and width of runways, nature of surfaces, elevation above sea level, hazards in the area, and the name, and method, of contacting the owner or controlling authority…

Such a catalogue was generally known as an ‘ALA register’.

Middle Island aeroplane landing area

The operator regularly conducted passenger charter flights from Agnes Water ALA to two beach ALAs at Aircraft Beach and Middle Island. Aircraft Beach was located just to the north of Middle Island ALA. The ALA at Middle Island was only used by the operator and was not a publically-listed ALA.

The operator’s Operations Manual included information about all three ALAs in an ALA register. The manual also contained a section written by the chief pilot on operations into both beach ALAs. Basic information about Middle Island ALA in the manual included:

• It was oriented in a 17/35 direction.
• It was 60-200 m wide and 8,000 m long, varying with tides.
• Tide heights were the most critical factor for landing, with the surface below the high tide mark (2.3 m) being sufficiently hard for a landing surface. Landings were only permitted if the tide was 1.7 m or less.
• The landing surface was fine, hard sand with a slight transverse slope.
• The natural indicator of hard sand was small sand balls made by ghost crabs.
• Ruts could be present on the beach after large tides or storm activity.

For landings at Middle Island ALA, the manual discussed hazards associated with the beach landing surface such as large ruts and tide movements. There was no information about the local terrain surrounding the ALA or the position, slope and condition of likely forced landing sites or associated hazards.

The ALA register in the Operations Manual included space for a diagram of each ALA. In the version of the manual submitted to CASA in August 2010, these spaces were blank.^[29] CASA advised that, as far as it could determine, it had not received or obtained any ALA diagrams from the operator. The pilot of the accident flight could not recall ever seeing any ALA diagrams, and another pilot who briefly conducted flights for the operator in late 2015 also reported that he had not seen any ALA diagrams and there were none contained in his copy of the Operations Manual. The chief pilot recalled preparing ALA diagrams but could not explain why they were not in the copy of the Operations Manual provided to CASA in August 2010.

Beach available for an emergency landing north of the landing area

A review of Google Earth images over the period from 2013 to 2019 showed that the size and shape of the sand areas around the Jenny Lind Creek inlet varied with tide height and also over time due to longer-term factors. Nevertheless, even though the accident flight arrived 2.5 hours before low tide, there was still a significant amount of beach on the island to the north of the landing area.

Figure 18 shows a Google Earth image of the landing area and beach north of the landing area. This image was taken in May 2016, and it was the Google Earth image that most closely represented the conditions at the time of the accident flight. Based on reviewing video footage taken from the accident flight, and the following flight in VH‑JER, there was significantly less beach area around Jenny Lind Creek inlet at the time of the accident compared to this Google Earth image. The width of the beach near the landing area was also slightly narrower. However, there was still a substantial amount of beach surface north of the landing area at the time of the accident.

Figure 18: Image of Middle Island aeroplane landing area and the beach area to the north

Note; Actual location of the ALA was not documented and the ATSB’s estimation of the ALA’s location is based on GPS locations of previous landings and take-offs. Source: Google earth, modified by the ATSB.

Figure 19 shows the beach area to the north of the accident site as seen just after the accident. As indicated in this image, most of the sand area shown in Figure 18 was present at this time. The beach included an area of shallow water just south of the accident site, areas of hard sand, areas of hard sand with ruts and very shallow puddles and areas of soft sand. Figure 20, also taken from VH-JER just prior to it landing, shows the beach from the accident site up to the camp site.

Figure 19: Image taken from VH-JER soon after the accident showing area of beach to the north of the landing area

Source: Queensland Police Service.

Figure 20: Image taken from VH-JER on approach to land soon after the accident showing area of beach to the north of the landing area

Source: Queensland Police Service.

In summary, most of the beach area north of the ALA indicated in Figure 18 was present at the time of the accident flight. More specifically, as indicated in the video footage from VH-WTQ, the aircraft was almost over the beach at the time of the engine power loss (1037:34). Figure 18 compares this location with the estimated touchdown point of VH-JER (heading south) a few minutes after the accident (see also Figure 6). Based on a review of video footage from VH‑JER, from 1037:38 (just after the pilot commenced a right turn), there was about 440 m (1,440 ft) along the beach until abeam where the aircraft wreckage was located. In addition, there was about 380 m (1,250 ft) from the accident site around to the north-west tip of the beach (past the camp site).

Airborne inspections and precautionary search and landings

General information about precautionary search and landing

The operator advised that its practices for conducting an airborne inspection of a beach ALA were based on the widely-known industry procedure for a precautionary search and landing.

A precautionary search and landing is a procedure for conducting a safe, powered landing away from an aerodrome or an ALA with known suitable landing surface conditions. It is normally conducted for two reasons:

• a landing on an unprepared landing surface made necessary due to an abnormal or emergency situation, such as deteriorating weather, insufficient remaining daylight, fuel shortage, technical problem, developing medical condition or any other reason determined by a pilot
• a pre-planned landing when the pilot is unfamiliar with the landing area or its condition is unknown.

Conducting a precautionary search and landing was a requirement for obtaining a private pilot licence (PPL). The relevant competency requirement included some key elements for conducting a search, but it did not prescribe the number of inspection circuits or height of each inspection. Pilots were not required to hold a low-level flying rating to conduct a precautionary search and landing procedure.

CASA did not provide pilots or operators with formal guidance material about conducting a precautionary search and landing. However, CASA’s Flight Instructor Manual (version 2, 2006) included the following guidance for flight instructors:

...fly parallel to and normally to the right of the proposed landing path. This run should be made with the optimum flap setting at slow cruising speed. This preliminary inspection should be sufficiently low for the surface to be inspected but not so low that it is necessary to avoid obstacles. If not satisfied with the surface complete at least one other inspection run at a lower height if necessary.

When satisfied with the area, complete a circuit keeping the field in sight.

A subsequent section of the Flight Instructor Manual on conducting an air exercise stated:

When in a suitable area descend to about 500FT above the ground…

Choose a suitable airstrip and demonstrate how to inspect the surface. Fly at low safe cruising speed with the optimum flap setting. Fly over the field slightly to the right of the intended landing path. Fly over the field slightly to the right of the intended landing path at about 100FT to make the first check. On this run check the surface and drift and note any high ground and obstacles in the overshoot area. Climb up to about 500FT and make a circuit keeping the field in sight and placing the aeroplane in a favourable position to make a dummy approach, again to the right of the landing path. On this approach re-check the surface and drift. Repeat the circuit and if quite satisfied with the surface carry out a short field landing procedure or go around procedure.

The information in the manual did not include the number of inspection circuits or recommended heights or configurations for a precautionary search.

CASA advised that many flying training organisations have adopted the guidance provided by the Aviation Theory Centre, a publisher of commonly-used flight training manuals in Australia. This guidance included the following for carrying out a safe approach and landing at an unfamiliar field with engine power available:

• conduct a first inspection at 500 ft AGL circuit height, slightly to the right of the landing area (to check for obstacles on approach and departure and general condition of the landing surface)
• conduct a second inspection at 200 ft, climb back to 500 ft before turning and conducting a 500 ft circuit (for a closer examination of the landing surface and other hazards)
• a third inspection at 50 ft, climb back to 500 ft before turning and conducting a 500 ft circuit (if required for a closer inspection of the landing surface)
• conduct the inspections with some flap extended (to provide a slower speed and other advantages, such as a smaller turn radius and better view from the cockpit due to a higher nose attitude).

The ATSB reviewed samples of guidance material about precautionary search and landing provided by or distributed by flying training organisations. The guidance was generally consistent with that provided by the Aviation Theory Centre, although some advocated that the second inspection should be conducted at 250 ft and some advocated that the third inspection should be conducted at 100 ft. Some guidance material advocated two inspections rather than three.

The Civil Aviation Authority of New Zealand (CAANZ) provided formal, detailed guidance for the conduct of a precautionary search and landing procedure. It advocated a first inspection at 500 ft and, if required, a second inspection no lower than 200 ft. It stated that:

Descent below 200 feet agl is not recommended, because it takes considerable concentration to fly the aeroplane level and look at the landing site surface. Also, there is a possibility of unseen obstructions, and since a climb to 500 feet agl will be initiated on completion of this inspection, the climb is minimised.

The major portion of the aeroplane’s inertia will be spent in the first two thirds of the landing roll. Therefore, it is generally recommended that the low-level inspection is not prolonged, but a climb to 500 feet agl initiated about two thirds of the way along the landing site…^[30]

None of the guidance material regarding precautionary search and landings reviewed by the ATSB specifically discussed the importance of considering (and managing the risk of) an engine failure while conducting a low-level inspection.

Civil Aviation Regulation 1988 (CAR) 157 (Low flying) stated that a pilot must not fly lower than 1,000 ft over built-up areas, or 500 ft over any other area. It also stated that this height was the height above the highest point of the terrain and any object on it within a radius of 600 m (for aircraft other than a helicopter). These requirements were also specified in the operator’s Operations Manual. CAR 157 also stated that the minimum height requirement did not apply if the aircraft was ‘actually taking-off or landing’ or conducting a baulked landing or missed approach. Flying a precautionary search and landing procedure below 500 ft of an ALA prior to landing was also exempt from the requirement.

Operator’s practices for airborne inspections of a beach landing area

The operator’s normal practice was to conduct an airborne inspection of the Middle Island ALA on the first fight of the day to the ALA and at other times when deemed by the pilot as necessary to inspect the beach landing surface. The chief pilot and pilot of the accident flight stated that between them they normally conducted one inspection each day that flights were conducted.

The chief pilot reported that, following a high tide, the beach conditions could change. The airborne inspection was therefore necessary in order to detect if there were any hazards such as ruts, pot holes, washaways, debris or areas of soft sand. He advised a good indicator of hard sand was the sand balls made by crabs.

The operator’s Operations Manual contained no guidance as to what height or configuration to use when conducting an airborne inspection, or how many passes to conduct. The manual required a pilot to look for the sand balls, and the chief pilot stated that in order to conduct an appropriate inspection (including looking for the sand balls) a pilot had to be at a low level.

In terms of how the operator’s pilots conducted airborne inspections at Middle Island:

• The chief pilot stated that he normally conducted the inspections at 50 ft above the landing surface, while flying to the north. He also advised that he conducted the inspections in a clean configuration (that is, with no flap selected and at normal cruise speed). He recalled being trained to conduct a precautionary search in a clean configuration so that there was less drag and more climb performance following the procedure.^[31]
• The pilot of the accident flight stated that he normally conducted the inspections at 150–200 ft, while flying to the north. As noted in the following section, review of GPS data for previous flights indicated that he normally conducted the inspections at 50–100 ft. The pilot also advised that he conducted the inspections in a clean configuration.
• Another pilot who briefly conducted flights for the operator in late 2015 stated that he conducted the inspections at not below 500 ft, while flying to the north, and if necessary would conduct additional passes at a lower height. He stated that he conducted the inspections either with a clean configuration or with 20º of flap, depending on the wind and other conditions at the time.

Both the chief pilot and the pilot of the accident flight advised the ATSB they were aware of the general industry guidance to conduct a precautionary search and landing with inspections at a series of decreasing heights. The pilot of the accident flight stated that such guidance applied to situations where a pilot was dealing with an unknown landing area, whereas their operations to Middle Island ALA involved a known landing area with conditions that could have changed.

The Operations Manual contained no guidance on what to do in the event of an engine failure at low level during an airborne inspection. The chief pilot stated that he had not considered the possibility of an engine failure during a low-level inspection. He also noted that pilots received training for engine failures at low level as well as precautionary search and landing during their basic training, and therefore he had not considered it necessary to require any further training or guidance in these areas.

Both the chief pilot and pilot of the accident flight noted that, at almost all stages of their flights to the beach ALAs, they had more than sufficient height to glide to and safely land on a beach in the event of an engine failure. They stated that the only exception, identified following the accident, was when doing an airborne inspection at the Middle Island ALA to the north (such as during the accident flight) (although see also Review of take-offs from Middle Island ALA and Operations over water and ditching procedures).

The pilot who briefly conducted flights for the operator in late 2015 stated that, depending on the position of the aircraft at the time of an engine failure, the best option would be to land on the remaining area of the ALA or the sand to the east of the camp site. He stated that although the latter area had soft sand, it was still a safer option than landing on the water.

Review of airborne inspections at Middle Island ALA

The ATSB reviewed the data on the GPS unit recovered from the accident site. A total of 19 airborne inspections of the Middle Island ALA were identified during the period from 12 November 2016 to 4 January 2017. Based on a high degree of correlation between the GPS data and the pilot of the accident flight’s logbook, it appeared that all of these inspections were conducted by the pilot of the accident flight.

• All of the airborne inspections involved flying slightly to the right of the ALA and heading north, towards Bustard Head. The average (mean) lowest altitude was 70 ft and the median was 56 ft.^[32] The lowest altitude for one inspection was 190 ft, two were about 110 ft, four were 70–90 ft, and the remainder (12) were 60 ft or lower.

Of the 19 airborne inspections:

• 11 were followed by a landing to the south on the ALA
• 6 were followed by a landing to the north
• 2 were immediately followed by a landing at the nearby Aircraft Beach ALA (prior to the aircraft returning to land at Middle Island ALA).

No airborne inspections of Aircraft Beach ALA were identified in the GPS data, even though that beach ALA was often used. The pilot of the accident flight advised the ATSB that, due to the firm and consistent nature of that beach, airborne inspections were not required. However, due to the potential for conditions to change at Middle Island ALA, an airborne inspection at that ALA was always required for the first flight after a tide.

Most of the airborne inspections that were followed by a landing on Middle Island ALA to the south involved the following pattern (Figure 21):

• the aircraft remained at about 50–100 ft above mean seal level (AMSL) until past the operator’s camp site (located at the northen end of the ALA)
• passing the camp site the aircraft climbed over the Jenny Lind Creek inlet
• the aircraft reached a maximum altitude of 450–600 ft AMSL while the pilot made a right turn over Bustard Head
• the pilot established the aircraft on the beach ALA centreline and conducted an approach and landing to the south.

Figure 21: VH-WTQ GPS-derived regular flight path for an airborne inspection on the southerly beach landing area (green line)

Source: Google earth, modified by the ATSB.

In general, the aircraft passed within 300 m to the east of the lighthouse (which had a focal height of 336 ft) on Bustard Head during the approach to landing, often at an altitude of about 450–500 ft AMSL, passing directly over terrain which was up to 280 ft AMSL. In a small number of cases, the right turn over Jenny Lind Creek was completed to the west of Bustard Head, with the aircraft reaching an altitude of 350–600 ft prior to the approach.

Most of the airborne inspections that were followed by a landing on Middle Island ALA to the north involved the following pattern (Figure 22):

• the aircraft remained at about 50–100 ft AMSL and flew past the operator’s camp site
• passing the camp site the aircraft commenced a climbing left turn over the Jenny Lind Creek inlet
• the aircraft reached a maximum altitude of about 300–400 ft AMSL while the pilot conducted a left circuit
• the pilot established the aircraft on the beach ALA centreline and conducted an approach and landing to the north.

Figure 22: VH-WTQ GPS-derived regular flight path for an airborne inspection on the northerly beach landing area (green line)

Source: Google earth, modified by the ATSB.

In all cases, there was a significant segment of the airborne inspection and climb out that had no suitable forced landing areas in the event of an aircraft emergency such as an engine power loss (Figure 21 and Figure 22). In none of the cases was a standard (four-leg) circuit pattern flown after the inspection.

The chief pilot stated that he conducted airborne inspections using similar flight paths as those shown in Figure 21 and Figure 22.

Airborne inspection procedures of another operator

The ATSB obtained the operations manual of another operator that routinely conducted passenger charter flights that involved landings at a beach ALA in small aeroplanes. The manual, last revised in 2015, included specific procedures that stated that beach landing area inspections had to be conducted no lower than 300 ft AGL.

The landing area inspections were generally conducted while flying downwind. However, the operations manual stated that inspections would typically be conducted ‘at an indicated airspeed no greater than 100 knots and it is preferable that a stage of flap is used for this procedure’.

This other operator’s beach ALA had significant areas of beach available at each end, and therefore a pilot could always land straight ahead in the event of an engine power loss during an inspection.

The other operator’s procedures also required that each pilot undergo a proficiency check every 90 days with a check pilot, and that such a check involved conducting a beach inspection.

Procedures following engine failure or power loss

Engine failure rates

A recent ATSB research study examined piston engine failures in small aircraft (up to 800 kg MTOW) in Australia between 2009 to 2014.^[33] The reported failure rate for Textron Lycoming engines was about 13 failures per 100,000 flight hours, Continental engines 12 per 100,000 hours and Rotax engines 15 per 100,000 hours. These statistics did not include fuel exhaustion or fuel starvation events.

These statistics indicate that, although engine failures are relatively rare, they do happen. Given the potential severity of the consequences of an engine failure or power loss in a single engine aircraft, such occurrences therefore need to be planned for and managed.

Training and guidance for managing an engine failure or power loss

An engine power loss after take-off is an event that occurs after the aircraft is airborne and on initial climb immediately after take-off, generally below circuit height, while being within close proximity to the departure aerodrome. Pilots are trained to deal with a total power loss scenario with a set of basic checks and procedures before their first solo flight. Furthermore, that training, which emphasises the limited time available to respond, is regularly practiced in an attempt to ensure that decision making and the conduct of appropriate actions by a pilot is second nature.

Pilots are generally taught that, if an engine fails at a low altitude, the safest course of action is to land in the most suitable area within about 30º left or right of the direction of flight. Pilots are also taught to only consider a turnback manoeuvre once they have achieved a minimum height, which may vary depending on the aircraft type and other factors.

A turnback following a low altitude engine power loss requires accurate flying, during a period of high stress and time pressure, to prevent a stall and possibly a spin occurring. If an aerodynamic stall and or spin occur at low level, there is little likelihood of recovery.

Successful completion of a turnback manoeuvre to land on a runway, beach, or other suitable area, requires well-developed procedures and good pilot proficiency to ensure these procedures are effectively applied. The impact of wind and weather conditions must also be accounted for when electing to conduct a turnback. During a turnback, pilots must constantly assess the ability of the aircraft to complete the procedure and be prepared at any time to cease the turn and land ahead.

In terms of minimum heights for considering a turnback, the United States’ Federal Aviation Administration (FAA) Airplane Flying Handbook (FAA-H-8083-3B) provided the following advice:

Consider the following example of an airplane which has taken off and climbed to an altitude of 300 feet above ground level (AGL) when the engine fails [Figure 23]. After a typical 4 second reaction time, the pilot elects to turn back to the runway. Using a standard rate (3° change in direction per second) turn, it takes 1 minute to turn 180°. At a glide speed of 65 knots, the radius of the turn is 2,100 feet, so at the completion of the turn, the airplane is 4,200 feet to one side of the runway. The pilot must turn another 45° to head the airplane toward the runway. By this time, the total change in direction is 225° equating to 75 seconds plus the 4 second reaction time. If the airplane in a power off glide descends at approximately 1,000 fpm, it has descended 1,316 feet placing it 1,016 feet below the runway.

Figure 23: Illustration of altitudes and distances required to conduct a successful turnback to a runway following an engine power loss at 300 ft

Source: Federal Aviation Administration.

A substantial amount of guidance material has been published about managing engine failures after take-off, and such guidance material continually emphasises the importance of not considering a turnback until a pre-determined safe altitude has been reached. For example, a recent article in CASA’s Flight Safety Australia publication (Stobie 2019) provided the following guidance:

If you’ve passed any level of licence, you’ve been taught how to handle engine failure. The specifics vary between types, but generally the doctrine is: maintain control, identify engine failure, conduct critical immediate actions, perform trouble checks which, if unsuccessful, leads into a forced landing procedure…

Something that should have stuck from basic training was that you should never turn back following engine failure immediately after take-off. There’s good reason for this lesson—countless fatal accidents have involved pilots unsuccessfully attempting to turn back to the airport following an engine failure on upwind at low level. It’s often labelled the impossible turn, and it’s a procedure fraught with risk.

At some point after departure though, returning to the airport is the safest option. A concept many single-engine operators use is a minimum turn-back height, which serves as a decision point within the take-off safety brief. The time to decide this is before take-off.

The minimum turn-back height splits a take-off safety briefing into three parts:

An event (engine failure or otherwise) before rotation, necessitating stopping/preparing for an overrun.

Engine failure between rotation and turn-back height, where you accept the off-airport landing and focus on preparing for that (choosing the most suitable area and configuring for the slowest landing and impact possible).

Engine failure above turn-back height, where you focus on a steep turn back and maximising glide performance to make it back to the airport.

A clear, defined plan removes indecision under pressure. You either are above or below your turn-back height; there’s no grey area. Formalising the decision relieves the temptation to attempt the impossible turn, and conducting a structured take-off safety brief diminishes the startle effect by placing the immediate actions in the forefront of your mind.

There are many considerations for nominating a minimum turn-back height—your abilities as a pilot, aircraft characteristics, wind direction and runway length, to name a few. An instructor familiar with your circumstances will be able to give you guidance here. Better yet, a dual training flight specifically on engine failure after take-off will allow you to determine exactly what height or point in the circuit you can consistently achieve a safe turn back.

CASA’s Flight Instructor Manual stated that, following an engine failure after take-off:

Choice of landing area and height available must be considered together. The amount of turn should be restricted to the minimum dictated by obstacles ahead. It must be stressed that the rate of descent and stalling speed will increase in any turn.

The manual included a diagram (Figure 24) showing the usual areas to consider for landing. It noted that the intention should be to have the wings level (after any turn) by no lower than 200 ft AGL.

Figure 24: Landing area selection following an engine failure soon after take-off

Source: CASA.

Responding to a total engine failure or power loss soon after take-off is undoubtedly an emergency situation associated with a high level of stress and time pressure, which can contribute to inappropriate decisions. There is a well-documented tendency for many pilots (including experienced pilots) to not land straight ahead, but rather attempt to turn back and land at the aerodrome. To help overcome this instinctive tendency, it is widely and strongly recommended that pilots mentally prepare for the possibility of an engine failure prior to take-off, and mentally rehearse the appropriate emergency response action immediately prior to take-off (for example, Civil Aviation Authority New Zealand 2015).

In general, managing a partial power loss in a single-engine aircraft can be more problematic than managing a total power loss, because a total power loss commits the pilot to an emergency landing. Guidance for the partial power loss situation has been provided by the ATSB.^[34]

Aircraft manufacturer’s procedures for managing engine failures

VH-WTQ was a Cessna 172M and VH-JER was a Cessna 172N. The Owner’s Manuals for these Cessna 172 models contained the following emergency procedure for an engine failure after take-off:

Prompt lowering of the nose to maintain airspeed and establish a glide attitude is the first response to an engine failure after take-off. In most cases, the landing should be planned straight ahead with only small changes in direction to avoid obstructions. Altitude and airspeed are seldom sufficient to execute a 180 degree gliding turn necessary to return to the runway. The following procedures assume that adequate time exists to secure the fuel and ignition systems prior to touchdown.

1) Airspeed – 75 MPH (flaps UP).
                       70 MPH (flaps DOWN).

2) Mixture – IDLE CUT-OFF.

3) Fuel Selector Valve –OFF.

4) Ignition Switch – OFF.

5) Wing Flaps – AS REQUIRED (40º recommended).

6) Master Switch – OFF.

Operator’s procedures and practices for managing engine failures

The operator’s Operations Manual stated, for each aircraft type (including the Cessna 172):

Manufacturers checklists for both Normal and Emergency Procedures will be used at all times.

In a section on the use of checklists, the manual stated:

The initial emergency check list actions for fire and/or engine failure are to be actioned by memory recall and completed by cross-check with the printed check list when time permits. The remaining emergency and abnormal check list items are generally to be completed by use of the printed check list.

Another section stated:

For all critical emergencies – e.g., engine failure or fire - Company pilots are expected to be capable of completing the initial actions (annotated *) by memory recall. Since in many instances time is of the essence and any delay in initiating the correct and timely action can severely degrade completion of a successful landing, Company pilots are encouraged to formulate an action plan for all critical phases of flight – such as take-off – and self-brief the initial immediate actions to be carried out in the event of a critical emergency.

The Operations Manual contained no information, procedures or instructions for managing specific emergencies, such as an engine power loss at low level after take-off (or during a go-around or airborne inspection). The manual also contained no guidance on minimum heights to achieve during a take-off before attempting a turn back following an engine failure.

Civil Aviation Regulation (CAR) 16(General requirements for aircraft on the manoeuvring area or in the vicinity of a non-controlled aerodrome) required that a pilot conducting a take-off from an uncontrolled aerodrome maintains the same track as the take-off until the aircraft is 500 ft above the terrain, unless it is necessary to avoid terrain.

The chief pilot indicated that his minimum height before conducting turns was 500 ft. He was aware of the guidance information regarding maintaining a straight heading after an engine failure or power loss unless a safe height had been reached, and that at 500 ft a safe turnback could be conducted. The other pilot who briefly conducted flights for the operator in late 2015 also advised that the normal take-off procedure was to reach 500 ft before turning. He also advised that his personal minimum before attempting a turnback would be 600–800 ft depending on the conditions.

The pilot of the accident flight advised that he would normally consider 400–500 ft as a minimum height after take-off before considering a turnback. He said he was aware of the risk associated with attempting a turn back to land following an engine failure soon after take-off, and he was aware of the industry guidance to land straight ahead or within a narrow arc (or ‘cone of commitment’). However, in the case of the accident flight, at the time of the engine power loss he believed a landing straight ahead would result in a ditching (see Engine power loss). He also believed that a ditching would involve a very high risk due to an aircraft with fixed landing gear likely to cartwheel or flip over. In addition, there was risk associated with a significant current in the channel (due to an outgoing tide), no life jackets on board the aircraft and bull sharks known to be in the channel.

The chief pilot advised the ATSB that the operator’s flights were very safe as they almost always had a (beach) runway underneath them. The chief pilot and the pilot of the accident flight stated most take-offs were to the south, so that they always had beach ahead of them during the climb. They also advised that, if they had to take-off to the north, they would taxi down the ALA to the south so that they would fly over the water at a safe height during take-off.

Review of take-offs from Middle Island ALA

The ATSB reviewed the recorded take-offs from Middle Island ALA on the GPS unit recovered from VH-WTQ. A total of 57 take-offs from Middle Island ALA were identified during the period from 12 November 2016 to 4 January 2017, with most (47) being flights to Agnes Water and the other 10 being flights to Aircraft Beach.

Most of the take-offs were conducted to the south on a flight back to Agnes Water ALA, with the aircraft maintaining a climb straight ahead over the beach until well above 500 ft. However, other flights included:

• Five flights conducted from Middle Island to Aircraft Beach that commenced with a take-off to the south, followed by a sharp turn to the right over terrain (three flights) or left over water (two flights), with the turns commencing below 200 ft AMSL.
• Two flights from Middle Island to Aircraft Beach that commenced with a take-off to the north, with both flights passing over the Jenny Lind Creek inlet at a low height soon after take-off before flying over Bustard Head, just to the right of the lighthouse and at a height of about 200 ft AGL (Figure 25).
• Two flights from Middle Island to Agnes Water that commenced with a take-off to the north, before turning to the left at a low height (below 200 ft AMSL) and then proceeding to Agnes Water (Figure 25).
• One flight from Middle Island to Agnes Water that commenced with a take-off to the south before turning sharply to the left over water, coming back over the northern end of the Middle Island ALA and descending to a lowest height of about 40 ft abeam the camp site, conducting a right turn around the Bustard Head lighthouse at an altitude of about 500 ft AMSL and then proceeding back to Agnes Water (see Figure 26).

In terms of approaches to Middle Island ALA, many of the approaches that did not involve an airborne inspection involved conducting a turn onto final approach below 500 ft AGL.^[35] The most notable flight was an approach to the Middle Island ALA from over the water down to about 80 ft abeam the camp site before a left circuit and return to a landing on Middle Island. During the left circuit the aircraft only reached a maximum altitude of about 200 ft AMSL (when over terrain of about 100 ft) (see Figure 26). This flight was conducted on the same day (1 January 2017) as the last take-off listed above.

Almost all of the specific flights listed above appeared to be conducted by the pilot of the accident flight as they matched flights documented in the pilot’s logbook. However, two of the flights were conducted on 1 January 2017, a day which the pilot did not record any flights in his logbook. There were also no flights certified on the aircraft’s maintenance release that day.^[36] The chief pilot stated that he could not recall conducting any flights in VH-WTQ following its last maintenance (on 20 September 2016), and also reported that no other pilots conducted flights for the operator during this period.

Figure 25: GPS flight paths of take-offs to the north flown in VH-WTQ

Source: Google earth, modified by the ATSB.

Figure 26: Additional observed GPS flight paths flown in VH-WTQ on 1 January 2017

Source: Google earth, modified by the ATSB.

In summary, there were several flights in VH-WTQ during the period from 12 November 2016 to 4 January 2017 at Middle Island where turns were conducted at less than 200 ft after take-off, including some flights over water. In addition, a number of flights involved segments where, if there was an engine failure, a forced landing on to water or hazardous terrain could not have been avoided. It was also relatively common practice to conduct manoeuvring below 500 ft AGL prior to being established on final approach.

The ATSB also reviewed some of the flights to or from Aircraft Beach. Most of the take-offs from Aircraft Beach were conducted to the north-west, and almost all of these involved sharp turns to the left after take-off at or below 200 ft. For many of these flights, if there was an engine failure, a forced landing on to water or hazardous terrain could not have been avoided. Many of the flights to Aircraft Beach involved flying the downwind circuit leg over water before conducting a left turn back to land on the beach. For some of these flights, it is very unlikely that the aircraft would have been able to conduct an emergency landing on land in the event of an engine failure towards the end of the downwind leg. In addition, many of the landings involved turns onto final approach below 500 ft AGL.

Manoeuvres during flights

Requirements for aerobatic manoeuvres

Civil Aviation Safety Regulations (CASR) 1998 (Dictionary, Part 1–Definitions) defined aerobatic manoeuvres as those that involve:

(a) bank angles that are greater than 60˚; or

(b) pitch angles that are greater than 45˚, or are otherwise abnormal to the aircraft type; or

(c) abrupt changes of speed, direction, angle of bank or angle of pitch.

To legally conduct aerobatic manoeuvres, pilots were required to have an aerobatics flight activity endorsement on their pilot’s licence. To obtain this endorsement, a pilot was required to have received training and demonstrated competency in relevant course units, including recovery from unusual attitudes and spins. CASR subpart 61.S (Flight activity endorsements) stated the requirements for aerobatic endorsements. These included:

• an initial aerobatic endorsement would authorise the pilot to conduct aerobatic manoeuvres in an aeroplane above 3,000 ft above ground level (AGL)
• subsequent endorsements were necessary for aerobatic activities at lower altitudes.

Civil Aviation Regulation (CAR) 155 (Aerobatic manoeuvres) stated additional requirements for aerobatics. These included that the only aerobatic manoeuvres that could be conducted were those specified within an aircraft’s certificate of airworthiness and/or flight manual.^[37]

The Cessna 172 was certified for operations in the normal and utility categories. The Cessna 172M Owner’s Manual stated:

The normal category is applicable to aircraft intended for non-aerobatic operations. These include any maneuvres incidental to normal flying, stalls (except whip stalls) and turns in which the angle of bank is not more than 60°…

This aircraft is not designed for purely aerobatic flight. However, in the acquisition of various certificates such as commercial pilot, instrument pilot and flight instructor, certain maneuvres are required by the FAA. All of these maneuvres are permitted in this aircraft when operated in the utility category…

Aerobatics that impose high loads should not be attempted… In the execution of all maneuvres, avoid abrupt use of controls…

To conduct manoeuvres in the normal category, the maximum gross weight was 2,300 lb (1,043 kg) and the flight load factors had to be +3.8 g to -1.52 g (with flaps up). The operator’s Cessna 172 charter flights were conducted in the normal category.

If the aircraft was flown in the utility category, the rear seat and baggage compartment had to be empty. The maximum gross weight was 2,000 lb (907 kg) and the flight load factors had to be +4.4 g to -1.76 g (with flaps up). The manual specified the specific types of aerobatic manoeuvres that were permitted, including steep turns, spins, lazy eights and chandelles. However, abrupt use of the controls for such manoeuvres was prohibited above 112 mph (97 kt).

• CAAP 155-1(0) (Aerobatics) provided pilots with information and guidance on safety aspects related to aerobatic flight. With respect to low-level aerobatic flight (below 3,000 ft), section 7.3.2 of the CAAP stated:

It is highly probable that the consequence of an error or failure during low-level aerobatics will be fatal to the participants.

Operator’s procedures and practices

The operator routinely conducted passenger charter flights from Agnes Water to either Middle Island ALA or Aircraft Beach ALA. These flights were advertised as including various manoeuvres en route to provide passengers with some ‘thrills’ or excitement.

Prior to such a flight, passengers were required to sign a consent form. The form stated:

Passenger request for the pilot to demonstrate manoeuvres within the “normal” ability of the aircraft. If you wish to experience angles of bank up to 60 degrees of bank and “G” forces from ‘0” G and up to 1.5 G force.

DO NOT SIGN THIS FORM IF YOU HAVE ANY FEARS OF FLYING OR HEIGHTS!

The chief pilot stated that passengers wanting a straight and level flight had to request this specifically. He also advised that the en route manoeuvres were an essential part of his business, as passengers wanted and ‘demanded’ the experience. The chief pilot and the pilot of the accident flight stated that the manoeuvres they conducted during their charter flights did not include aerobatic manoeuvres and they were within the required limits for the aircraft type.

Some of the operator’s passengers on the day of the accident indicated that, before arriving at Agnes Water and signing the consent form, they were aware that their flight would include various manoeuvres not normally performed on a passenger charter flight.

The operator’s Operations Manual contained no specific procedures outlining how the en route manoeuvres were to be conducted. Instead, the manual stated:

Passenger comfort is also complementary to safety and in order to maintain maximum passenger comfort and confidence in the air, pilots should take all reasonable steps to avoid:

• areas of atmospheric turbulence;

• sudden or violent flight manoeuvres;

• steep turns; and

• descending at a rate of more than 1000 feet per minute.

Another section of the manual stated that, during cruise:

No turns exceeding 30° angle of bank.

The operator’s Operations Manual contained a section on the conduct of aerobatic flight. It stated:

Acrobatic^[38] flight may only be performed in company aircraft approved for the purpose. Only those pilots specifically authorised by the Chief Pilot are permitted to conduct acrobatic flight, and their personnel records must be certified accordingly.

Acrobatic flight may not be performed at such a height that recovery from any manoeuvre cannot be accomplished by 3000 feet above the highest point of the terrain…

Neither the chief pilot or the pilot of the accident flight held an aerobatics flight activity endorsement on their pilot’s licence.

Manoeuvres conducted during the accident flight

Following the accident, CASA conducted a regulatory review of the operator’s operation and the suitability of the chief pilot and the pilot of the accident flight to maintain their pilot licences. As part of its investigations, it reviewed the video footage of the flight (obtained from the police) and other information. Ultimately, CASA concluded that:

During the flight the pilot engaged in manoeuvres that are capable of being characterised as “aerobatic manoeuvres” as per the definition in Part 1 of the Dictionary in the Civil Aviation Safety Regulations 1998 (CASR). Namely, the observed manoeuvres appear to involve abrupt changes in speed, direction, angle of bank or angle of pitch. The aircraft was observed at various times to bank steeply and to engage in abrupt pitch changes where the aircraft climbs and then steeply descends so as to result in a negative-g situation.

Irrespective of whether the observed manoeuvres were aerobatic in nature, they should not have been engaged in during the course of a charter operation with passengers on board… The act of initiating abrupt pitch control inputs, and high angle of bank manoeuvres below 1000 feet AGL reduces the ability of the pilot to effect a safe outcome subsequent to unexpected aircraft malfunction, or loss of situation awareness leading to altitude loss…

The chief pilot and pilot of the accident flight stated they had reviewed the video footage from the accident flight, and they believed that none of the manoeuvres were aerobatic. The chief pilot analysed a steep right turn conducted during the flight, and believed it to be conducted with a maximum bank angle of 57°.

The ATSB reviewed the video footage. It determined that the steep right bank conducted during the flight briefly reached a maximum bank angle of 65–70°.

Survival aspects

Occupant injuries

The more significant injuries sustained by the four occupants during the impact were (from front to back):

• Pilot in front left seat (seriously injured): fractures of the back and legs, lacerations to the head.
• Front right-seat passenger (seriously injured): broken feet, hairline fracture of the spine, lacerations to the head.
• Rear left-seat passenger (fatally injured): fractured vertebrae in the neck, significant cardiovascular injury, fractured ribs, fractured left upper arm.
• Rear right-seat passenger (seriously injured): fractured vertebrae in the neck, significant internal head injury, fractured pelvis, fractured left ankle.

The rear left-seat passenger’s neck and cardiovascular injuries were not survivable. The front-seat occupants were both conscious immediately following the accident, but the right rear-seat passenger was unconscious and in a coma for an extended period.

There was no evidence from the deceased passenger’s post-mortem examination to indicate that she had been struck from behind by any object (such as loose baggage or camp supplies). Similarly, the injuries reported by the other rear-seat passenger were not consistent with being struck from behind.

Impact forces and survivable space

The distance between the nose impact point to where the aircraft came to rest was about 5 m. The angle of impact was calculated to be greater than 45° nose down and about 60° left bank. The aircraft’s airspeed at the time of impact was about 60 kt (or about 110 km/h). Although the aircraft’s forward speed was not high for an aircraft accident, the short wreckage trail distance and high angle of impact in combination indicated that the aircraft decelerated in a short period of time. This meant that significant impact forces would have been imparted on the aircraft’s occupants.

The liveable space in the aircraft was compromised by significant damage to the cockpit and cabin area. This made it more likely that the aircraft occupants would come in contact with the aircraft structure during the accident sequence, particularly for occupants in the front and/or left side.

Seat belts and upper torso restraints (UTRs)

Requirements

CASR 90.105 required that the seats in the front row of an aircraft must be fitted with an approved safety harness. For small aeroplanes (with MTOW less than 5,700 kg) and helicopters, the safety harness needed to consist of a lap belt and at least one shoulder strap. In Australia, this requirement was specified in a 1995 airworthiness directive (AD) for all aircraft, and previous requirements for new aircraft, until transferred to CASR 90.105 in 2010.

CASR 90.110 required that, for small aeroplanes manufactured on or after 13 December 1986,^[39] each seat in the aircraft being used during take-off or landing must have an approved seat belt and shoulder harness. CASR 90.115 stated a similar requirement for helicopters manufactured on or after 17 September 1992. These regulatory requirements were based on requirements introduced by the United States’ Federal Aviation Administration (FAA) in response to a series of recommendations and safety studies (see Appendix C).^[40] In Australia, these requirements were initially specified in ADs until they were transferred to CASR Part 90 in 2010.

In this report, the term ‘upper torso restraint’ (UTR) is used to refer to a shoulder harness or shoulder strap.

Seat belts in VH-WTQ

Consistent with the regulatory requirements, the two front seats of VH-WTQ (manufactured in 1973) were fitted with a lap belt and UTR (similar to those fitted standard to modern road vehicles) and the two rear seats were fitted with lap belts only. Each of the lap restraints were attached to attachment points on the floor and the UTRs for the front seats were attached to attachment points on the roof structure. If UTRs had been fitted for the rear seats, they would also have been attached to attachment points on the roof structure.

All the occupants were wearing the provided restraints at the time of the accident. There was no indication that any of the restraints had failed. However, during the impact sequence, the floor and roof structures were compromised. In addition, both the front seats and the rear bench seat separated from the floor structure in overload.

The operator’s other Cessna 172 aircraft, VH-JER, was manufactured in 1978 and also did not have UTRs fitted for the rear passenger seats.

Research into the benefits of UTRs

A substantial amount of research has consistently shown that seat belts in small aircraft that include a UTR significantly reduce the risk of injury compared to lap belts only. UTRs minimise the flailing of the upper body and reduce the risk of impacts involving the head and upper body.

For example, a safety study by the United States’ National Transportation Safety Board (NTSB) in 1985 examined 535 accidents involving small aircraft in 1982.^[41] It estimated that 20 per cent of the 800 fatally injured occupants would have had only serious injuries or minor injuries if they had been wearing a UTR. In addition, 88 per cent of 229 seriously injured occupants would probably have had less severe head or upper body injuries, only minor injuries or no injuries if they had been wearing a UTR.

A 2011 safety study by the NTSB examined the rate of serious and fatal injuries of pilots in single-engine aeroplanes during the period 1983–2008. It found that pilots wearing only a lap belt had a 49 per cent greater likelihood of a serious or fatal injury compared with pilots wearing a lap belt and a UTR. Another study which examined take-off and landing accidents involving an engine power loss during 1983–1992 found that pilots wearing only a lap belt were 70 per cent more likely to be fatally injured than pilots wearing a seat belt and a UTR (Rostykus and others 1998).

In general, the forces transmitted to occupants in small aircraft involved in an accident are higher than those transmitted in large transport aircraft involved in an accident. This is still the case when taking into account the lower initial impact energy from slower speeds in small aircraft. The higher impact forces transmitted to occupants is primarily due to the lack of protection from a crushable fuselage structure and therefore reduced energy absorption in a small aircraft (CASA 2001). Front seat occupants in small aircraft will generally be exposed to higher impact forces than other occupants (assuming they are wearing the same types of restraints), but the other occupants can still be exposed to significant forces.

Recommendations for the fitment of UTRs in all seats

Based on the substantial body of research, there have been many recommendations over the years for UTRs to be fitted to all seats in small aeroplanes manufactured before December 1986, particularly for passenger transport operations (Appendix C). These recommendations have been made by investigation agencies in the United States, Canada, the United Kingdom and Australia. To date, none of these recommendations have resulted in any changes to the minimum requirements (see Appendix C).

In Australia, the then Bureau of Air Safety Investigation (BASI)^[42] issued Recommendation R19980281 to CASA in March 1999, following a fatal accident involving a Cessna 185 floatplane.^[43] The recommendation stated:

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority mandate the compliance of all manufacturers' service bulletins relating to the provision of upper body restraint to occupants of FAR part 23 certified aircraft engaged in fare-paying passenger operations, and emphasise compliance with their instructions on the correct use of the restraint systems.

CASA issued a Discussion Paper for a proposed regulatory change in 2001. In its assessment of the responses to the Discussion Paper, CASA noted that there were difficulties estimating the true costs and benefits, and it concluded that proceeding with a comprehensive cost-benefit analysis was not warranted. It also advised the ATSB in July 2002 that:

The installation and use of shoulder harnesses for all occupants in small aircraft will be strongly recommended to operators and the travelling public, and CASA will publicise the benefits of shoulder harnesses in this class of aircraft. This will be done in the expectation that the air-travelling public will become aware of the desirability of shoulder harnesses; and operators who can make this modification without threatening their economic viability will consider doing so.

The ATSB accepted CASA’s response and closed the recommendation, stating:

While acknowledging the efforts of the Civil Aviation Safety Authority in responding to this recommendation, the Australian Transport Safety Bureau will continue to monitor occurrences involving occupant restraints.

In May 2019, the ATSB asked CASA about what guidance information it had provided operators and/or the travelling public either recommending the use of UTRs or advising of their benefits. CASA replied that, other than the Discussion Paper released in 2001, it could not identify any other guidance information it had provided.

Availability of UTRs for retrofitting aircraft

In September 1992, Cessna issued a mandatory Single Engine Service Bulletin (SEB) SEB92‑28,^[44] which stipulated the fitment of seat belt (lap belt) and shoulder harness installation for single engine airplanes not equipped with such equipment in all seat locations. The SEB stated the purpose of the service bulletin was:

To provide a metal connection type seat belt shoulder harness assemblies for all seat locations. The assemblies utilize a metal-to-metal mechanism to latch the shoulder harness to the seat belt.

Beginning with the 1971 model year, seat belts and shoulder harness assemblies incorporating the metal-to-metal connectors were provided as standard equipment for the front seats and optional equipment for all other passenger seats.

Seat belt and shoulder harness assemblies with metal parts as described above are listed in the Material Section of this Service Bulletin and must be installed in all seat locations.

WARNING: FAILURE TO INSTALL AND PROPERLY UTILIZE SEAT BELTS AND SHOULDER HARNESSES COULD RESULT IN SERIOUS OR FATAL INJURY IN THE EVENT OF AN ACCIDENT.

The SEB stated that compliance was mandatory within 400 hours or 12 months, whichever occurred first. The aircraft manufacturer also issued a mandatory multi engine service bulletin (MEB) at that time to cover some types of twin engine aircraft.

Cessna advised that the cost of a UTR kit could vary depending on the aircraft type and the supplier, and that it would normally take about 30–90 minutes to install. Current advertised prices of a UTR kit for a Cessna 172 are well below US$1,000.

Some other major aircraft manufacturers issued similar mandatory service bulletins at about the same time.^[45] Although these service bulletins were classified as mandatory by the aircraft manufacturers, Australian operators were not required to comply with the bulletins. During the course of previous investigations, CASA advised the ATSB that mandatory service bulletins from aircraft manufacturers are not mandatory unless the operator was maintaining its aircraft to the manufacturer’s maintenance schedule or the regulator from the country of manufacture issued an airworthiness directive that specifically mandated the service bulletin.

Following a recommendation in 2001 by the United Kingdom’s Air Accident Investigation Board (AAIB) (see Appendix C), the United Kingdom’s Civil Aviation Authority evaluated the costs and benefits involved in retrofitting aircraft with UTRs in all seats. It noted that for some aircraft fitting additional UTRs may be simple but for some aircraft the costs may be more significant. It stated, based on data supplied by Cessna, Raytheon and a Supplemental Type Certificate holder, an average cost per seat in 2003 was about US$1,800 (including US$1,000 for parts). Although this average cost would be higher in 2019, it should be noted that the cost for aircraft where kits are already available (such as for Cessna single engine aircraft) would generally be less.

Extent to which aircraft have been retrofitted with UTRs

It is generally assumed that the proportion of the civil aviation fleet that do not have UTRs in all passenger seats will decrease over time as older aircraft are retired and the proportion of the fleet manufactured after 1986 (for small aeroplanes) or 1992 (for helicopters) increases.

It is difficult to determine how many of the existing fleet being used for passenger transport operations was manufactured prior to 1986 and still do not have UTRs fitted to all passenger seats. At the time of its recommendation in 1999, BASI noted that (at that time) very few of the aircraft had been retrofitted. The ATSB has not identified any evidence to suggest this situation has changed. For almost all (18 of 20) the passenger transport accidents (resulting in fatal or serious injuries) involving small aeroplanes in Australia during 1998–2018, the aeroplanes were manufactured before 1986 (see Appendix C). Even during the last 10 years of this period (2009–2018), the majority of the aeroplanes involved (5 out of 7) were manufactured before December 1986. In the ATSB’s experience, for most of the accidents it has investigated involving small aeroplanes manufactured before December 1986, these aeroplanes had not been retrofitted with UTRs in all passenger seats.

In 2018, Textron Aviation advised the ATSB that, for various reasons, it was unable to state how many UTR kits had been sold for Cessna and Beech aircraft based in Australia.

In a recent safety study, the NTSB (2011) noted that a large proportion (69 per cent) of the active general aviation fleet in the United States in 2008 were manufactured before 1984. It also noted there was still a substantial number of small aeroplanes being used that had not been retrofitted.

Guidance information about UTRs

As previously noted, aircraft manufacturers such as Cessna have published safety information letters and service bulletins, encouraging the fitment of UTRs to passenger seats that did not have UTRs fitted when the aircraft were manufactured.

Regulatory authorities in some countries have also published advisory information about the benefits of installing and using UTRs. For example, the FAA issued Advisory Circular (AC) 21-34 (Shoulder harness – Safety belt installations) in 1993. The AC outlined the justification for installing a UTR, and provided guidance on factors to consider when installing a UTR. The FAA also issued a safety pamphlet in 1995 titled Seat Belts and Shoulder Harnesses: Smart Protection in Small Aeroplanes. The pamphlet advocated for the installation of UTRs in all seats.

Transport Canada Advisory Circular No. 605-004 (Use of seat belts and shoulder harnesses on board aircraft, issue 2, 2014) provided information on the benefits of UTRs and recommended their use in all small aircraft. It stated:

Accident experience has provided substantial evidence that the use of a shoulder harness in conjunction with a safety belt can reduce serious injuries to the head, neck, and upper torso of aircraft occupants and has the potential to reduce fatalities of occupants involved in an otherwise survivable accident…

As noted above, no similar guidance information has been issued in Australia by CASA.

Passenger briefings

Civil Aviation Order (CAO) 20.11 (Emergency & life saving equipment & passenger control in emergencies) stated an operator shall ensure all passengers are provided with an oral safety briefing before each take-off. The briefings were required to include (among other things) the use and adjustment of seat belts, the location of emergency exits and the use of floatation devices (where applicable). There was no requirement to orally brief the brace position.

A safety briefing card was only required for regular public transport and passenger charter flights in aircraft with a seating capacity of more than six (including crew). Such a briefing card was required to include, among other things, the brace position for emergency landing or ditching.

The operator’s Operations Manual stated that the passenger briefing before flight was to include the use and adjustment of seat belts and the location and operation of normal and emergency exits. There was no requirement to brief on the brace position, and no safety briefing cards were used.

The pilot of the accident flight reported that he conducted a passenger briefing prior to the flight, which covered aspects of the seat belts and the exits. He advised that he did not provide advice on the brace position, nor was that required.

Operations over water and ditching procedures

Civil Aviation Regulation (CAR) 258 (Flights over water) stated that a pilot must not fly a single-engine aircraft over water at a distance from land greater than the distance from which the aircraft could reach land if the engine was inoperative. However, operations over water were permitted ‘in the course of departing from or landing at an aerodrome in accordance with a normal navigational procedure for departing from or landing at that aerodrome’. In addition, the Aeronautical Information Publication (AIP) stated in ENR 1.1 that CAR 258 did not apply to charter, aerial work or private operations if each occupant was wearing a life jacket, unless they were exempted from doing so under CAO 20.11 (see Life jackets).^[46]

It is a common view that ditching an aircraft with a fixed landing gear is associated with more risk than ditching an aeroplane with retractable landing gear (with the landing gear retracted). In addition, some have expressed the view that ditching an aeroplane with a high wing is associated with more risk than ditching an aeroplane with a low wing.

Civil Aviation Advisory Publication (CAAP) 253-1(1) (Ditching), issued in 2010, provided general guidance to operators and pilots regarding ditching. It included, for aeroplanes with retractable landing gear, ditching with the landing gear selected up. It also stated:

Aeroplanes with fixed undercarriages strike the water wheels first. This is most likely to cause violent nose down pitch with the aeroplane ending up in a near vertical position with the nose buried under the water. Individual aeroplane design may have a significant effect on this outcome with aeroplanes with a significant amount of their structure ahead of the main wheels performing in a less violent manner; however, a misjudged flare may exacerbate the consequences of a ditching…

After the aeroplane has come to rest, high wing aeroplanes may quickly assume an attitude where most of their fuselage, and therefore you, is under water. Low wing aeroplanes are more likely to keep the fuselage above water. How long either type stays in that position before sinking is related to many issues…

The chief pilot and pilot of the accident flight both stated that they had previously discussed the risk associated with ditching a Cessna 172 (with a fixed landing gear) in the water. The chief pilot stated that, because of his concerns about this risk, he included the following statement in the Operations Manual:

Company policy dictates that over water flight are only to be under-taken in aeroplanes with retractable undercarriages.

The Cessna 172 Owner’s Manual included an emergency procedure for ditching (or an intentional emergency landing on water). The procedure included planning the approach into wind, using full flap and sufficient power for a minimum 300 ft/min descent rate at 70 mph (61 kt) and maintaining a continuous descent until touchdown in a level attitude. The procedure also included unlatching the cabin doors prior to touchdown, and placing a folded coat or cushions in front of the occupants’ faces at the time of touchdown.

Research has shown that ditching a high-wing aeroplane with fixed landing gear is normally successful. Newman (1988) conducted a review of ditchings obtained from the NTSB aircraft accident database between 1979 and 1983. There were 144 ditchings in certified single-engine aeroplanes. Of the 77 ditchings involving high-wing aeroplanes with fixed landing gear, eight  (10 per cent) resulted in one or more fatalities. There was no significant difference between high-wing (12 per cent) and low-wing aeroplanes (12 per cent), and between aeroplanes with fixed landing gear (13 per cent) and retractable landing gear (12 per cent). The proportion of light, multi-engine aeroplane ditchings that resulted in fatalities appeared to be higher (20 per cent), but the difference was not statistically significant.

Newman noted that using the proportion of ditchings that had fatalities as an indicator of risk was problematic, as in some cases the occupants may have survived the ditching but not survived during the period after egressing the aircraft. The review also noted that the proportion of ditchings with fatalities for retractable landing gear aeroplanes may be confounded by the presence of some high performance aeroplanes (with higher landing speeds) in this sample.

The ATSB reviewed the NTSB aircraft accident database for all occurrences involving Cessna 172 and 182 aircraft with fixed landing gear between 1998 and 2017 where the words ‘ditching’ or ‘ditched’ was used in the available NTSB report. There were 17 ditchings, and 16 resulted in no fatalities or serious injuries.^[47] With regard to the other accident, none of the three occupants were injured during the ditching, but two did not survive and the other was seriously injured after egressing the aircraft.

Life jackets

CAO 20.11 paragraph 5.1.1 required that a single-engine aircraft be equipped with a life jacket for each occupant when the aircraft was over water and at a distance from land ‘greater than that which would allow the aircraft to reach land with the engine inoperative’. However, this did not apply to an aircraft ‘departing from or landing at an aerodrome in accordance with a normal navigational procedure for departing from or landing at that aerodrome’.

In addition, CAO 20.11 paragraph 5.1.2 stated that passenger-carrying charter aircraft:

shall be equipped with a life jacket or floatation device for each occupant on all flights where the take-off or approach path was so disposed over water that in the event of a mishap occurring during the departure or the arrival it was reasonably possible that the aircraft would be forced to land onto water.

The operator’s Operations Manual included requirements for life jackets that were consistent with CAO paragraph 5.1.1. However, it did not include any requirement related to paragraph 5.1.2.

The operator’s passenger-carrying charter flights from Agnes Water to Middle Island (including the accident flight) were not equipped with life jackets. The flights frequently involved operations over water at a low altitude for a brief period as part of an airborne inspection (see Operator’s practices for airborne inspections of a beach landing area and Review of airborne inspections at Middle Island ALA). A number of other flights also involved operations over water during approach or take-off (see Review of take-offs from Middle Island ALA), although the extent to which passengers were carried on those flights could not be determined.

Life rafts

CAO 20.11 section 5.2 also stated that life rafts were required to be carried for single-engine aircraft conducting flights more than 30 minutes or 100 miles from land. The operator’s Operations Manual included requirements for life rafts that were consistent with the CAO.

On the operator’s flights from Agnes Water to Middle Island and Aircraft Beach (including the accident flight), aircraft were not equipped with life rafts, nor were they required to under section 5.2 of CAO 20.11.

Emergency locator beacon

CAR 252A (Emergency locator transmitters) required that an aircraft could only begin a flight if it was fitted with an approved fixed emergency locator transmitter (ELT) or an approved portable ELT. Various exemptions applied, which included no requirement to carry an ELT if the flight was to take place wholly within 50 miles of the departure aerodrome. Approved ELTs and approved portable ELTs had to meet various requirements, which included the ELT being registered with the Australian Maritime Safety Authority.

The operator’s Operations Manual detailed the minimum emergency equipment to be carried for a charter flight. This included a portable emergency locator beacon (ELB) if the aircraft was not fitted with a fixed ELT. VH-WTQ was not fitted with a fixed ELT.

The ATSB on-site inspection of VH-WTQ identified a portable ELB was on board the aircraft at the time of the accident. However, its registration expired in August 2015. In addition, it was registered to the previous owner of the aircraft, based in Victoria, who had no connection to the operator. As a result, if the ELB had been activated, a subsequent search may have been adversely affected.

The ELB was not required to be activated for the accident flight, due to people on the camp site and the chief pilot (and pilot of VH-JER) being aware of the accident and notifying emergency services promptly.

Organisational information

Operator history

The operator, Wyndham Aviation Pty Ltd, held an Air Operator’s Certificate (AOC) that authorised it to conduct passenger charter operations in Australian territory in single engine piston aeroplanes not exceeding 5,700 kg maximum take-off weight (MTOW). The AOC was initially issued to the operator in June 2009 (for 3 years) and last reissued in June 2015 (for 3 years).

The operator was based at Agnes Water and it primarily utilised its two Cessna 172 aircraft (VH‑JER and VH-WTQ). The majority of its flights involved transporting passengers from Agnes Water ALA to and from camp sites at two nearby beach ALAs, at Middle Island and Aircraft Beach. The operator had conducted these operations since 2009 as Wyndham Aviation, with the chief pilot conducting similar flights before then under a different arrangement (see Investigation of a complaint in 2007).

The operator conducted flights to the beach ALAs on most days, and transported up to 20 passengers a day.

The operator also carried out a small amount of general charter work utilising a Beechcraft A36 Bonanza. All operations were conducted under visual flight rules (VFR).

Personnel

At the time of the accident, the operator had two operational personnel:

• The chief pilot, who was the owner, managing director and chief executive officer of Wyndham Aviation. He controlled the day-to-day management of the organisation as well as supervising its flight operations. In addition, he held the position of head of aircraft airworthiness and maintenance control (HAAMC). The chief pilot conducted most of the operator’s flights, normally in VH-JER. He also managed the commercial side of the operation, and was actively involved in managing the commercial activities at the camp sites.
• The pilot of the accident flight, who had conducted many flights for the operator over the previous 6 years, normally in VH-WTQ.

In late 2015, another pilot briefly conducted flights for the operator while acting in the role of chief pilot (when the regular chief pilot was on leave). The regular chief pilot reported that no other pilots conducted flights for the operator during the period from mid 2010 until the time of the accident.

The position of chief pilot was defined in Section 28(3) of the Civil Aviation Act 1988 as being a key position within an AOC holder’s organisational structure.

CAO 82.0 Appendix 1 outlined the responsibilities of a chief pilot. Those included but were not limited to:

• ensuring flight operations were conducted in compliance with the legislation
• maintaining a record of flight crew licences and qualifications
• ensuring compliance with aircraft loading procedures
• monitoring operational standards of flight crew
• supervising the training and checking of flight crew
• maintaining a complete and up-to-date reference library of operational documents.

CASA’s Chief Pilot Guide described the chief pilot position as one requiring:

… a focus on regulatory compliance and is a critical link between the AOC holder and CASA. To be effective in the role, Chief Pilots must have the knowledge, experience and strength of character to balance the sometimes conflicting demands of safety and commercial considerations.

According to the operator’s Operations Manual, the HAAMC was responsible for, among other things, monitoring aircraft hours, scheduling periodic maintenance, arranging defect rectification and unscheduled maintenance and compliance with airworthiness directives.

Operations manual

Civil Aviation Regulation (CAR) 215 (Operations manual) required an operator to provide an operations manual for the use and guidance of its personnel. The manual was required to contain information, procedures and instructions for flight operations of all types of aircraft operated by the operator to ensure their safe conduct. In accordance with the CARs, the operator’s personnel were required to comply with the instructions in the manual. CAAP 215-1(2) (Guide to the preparation of Operations Manuals) provided operators with detailed guidance.

The operator published the first version of its Operations Manual in May 2009, with several sections amended in August 2010. A small number of minor amendments were made after this time.

Training and checking

The operator did not have, and was not required to have, a flight crew check and training system as specified in CAR 217 (Training and checking organisation).^[48] The required recurrent reviews and proficiency checks for the operator’s pilots were:

• an aeroplane flight review (AFR) conducted every 2 years (which was required to exercise the privileges of the pilots’ licences)
• an emergency procedures proficiency check conducted every 12 months, as required by CAO 20.11 (Emergency & life saving equipment & passenger control in emergencies).^[49]

No other recurrent reviews or proficiency checks were normally required for a charter operator using small aircraft, unless it was required to have a CAR 217 training and checking organisation (in which case two proficiency checks were required for each pilot a year) or its pilots conducted instrument flight rules (IFR) operations (in which case each pilot was required to conduct a proficiency check to maintain the instrument rating every 12 months).

The chief pilot did not hold, nor was he required to hold, any check or training pilot approval or instructor rating. Both the chief pilot and the pilot of the accident flight normally undertook their AFRs with the same instructor, in either Cessna 172 or Beechcraft A36 aircraft. These flight reviews covered the basic requirements of a flight review for a pilot who held a CPL and held an endorsement to fly single-engine (piston engine) aeroplanes less than 5,700 kg MTOW. The AFRs were not specifically tailored to the operator’s operations, and did not involve conducting an airborne inspection of a beach ALA.

The only check flights referred to in the operator’s Operations Manual was an initial check to be conducted prior to a pilot being able to conduct a landing at either Aircraft Beach or Middle Island. These checks were to be conducted by the chief pilot. There was no record in the pilot of the accident flight’s file to indicate that he had been checked before conducting beach landings. However, he reported that he conducted a number of flights with the chief pilot as an observer and then a number with the chief pilot under supervision before he was allowed to conduct operations in to the beach ALAs alone. The chief pilot and pilot of the accident flight reported that, following this induction period, they rarely flew together in the same aircraft (although they conducted flights at the same times in different aircraft to the same ALAs).

The pilot who briefly conducted flights for the operator in late 2015 reported that he received a briefing from the chief pilot and undertook some supervised flights with the chief pilot prior to being approved to conduct operations alone at the beach ALAs. He reported that when he was acting as chief pilot, he conducted most of the operator’s flights (and the airborne inspections). He observed aspects of some flights conducted by the pilot of the accident flight (when he was flying the operator’s other aircraft), and he did not observe anything that contravened the operator’s Operations Manual or caused him concern. As noted in previous sections, this pilot’s description of how he conducted airborne inspections was significantly different to that provided by the chief pilot and the pilot of the accident flight (see Operator’s practices for airborne inspections of a beach landing area).

The operator did not have, nor was a charter operator required to have, a safety management system (SMS).

Further information regarding the operator’s history is provided in Oversight of Wyndham Aviation and its key personnel.

Regulatory oversight

The function of the Civil Aviation Safety Authority

CASA was responsible, under the provisions of Section 9 of the Civil Aviation Act 1988, for the safety regulation of civil aviation in Australia and of Australian aircraft outside of Australia. Section 9(1) stated the means of conducting the regulation included:

(c) developing and promulgating appropriate, clear and concise aviation safety standards;

(d) developing effective enforcement strategies to secure compliance with aviation safety standards…

(e) issuing certificates, licences, registrations and permits;

(f) conducting comprehensive aviation industry surveillance, including assessment of safety‑related decisions taken by industry management at all levels for their impact on aviation safety…

The two primary means of oversighting a specific operator’s aviation activities were:

• assessing applications for the issue of or variations to its AOC and associated approvals (including approvals of key personnel)
• conducting surveillance of its activities.

Processes for assessing variations to approvals

CASA was required by Section 28 of the Civil Aviation Act 1988 to satisfy itself about various matters when processing an application for the issue of, or variation to, an AOC. The matters included whether the organisation was suitable and whether it had suitable procedures and practices to ensure that AOC operations were conducted safely.

CASA’s procedures and guidance for assessing an application for the issue of, or variation to, an AOC were contained in the Air Operator Certification Manual (AOCM) up until October 2012, and the Air Operator’s Certificate Process Manual from October 2012 (with industry guidance provided in the Air Operator’s Certificate Handbook).

Processes for conducting surveillance

Introduction

CASA developed a surveillance program to determine whether aircraft operators and other organisations were meeting the regulatory requirements. CASA’s surveillance program was documented in various manuals over the years. From November 2003 the primary manual was the Surveillance Procedures Manual (SPM), and from July 2012 the primary manual was the CASA Surveillance Manual (CSM). With the introduction of the CSM, CASA also started using Sky Sentinel, an information technology tool designed to help manage surveillance activities.

The CSM stated:

Surveillance is the mechanism by which CASA monitors the ongoing safety health and maturity of authorisation holders. Surveillance comprises audits and operational checks involving the examination and testing of systems, sampling of products, and gathering evidence, data, information and intelligence. Surveillance assesses an authorisation holder’s ability to manage its safety risks and willingness to comply with applicable legislative obligations.

The manual also stated that CASA encouraged the aviation industry to adopt standards higher than the minimum required by regulations.

The ATSB investigation report AO-2009-072 (reopened),^[50] released in November 2017, provided a detailed overview of CASA surveillance processes relevant to charter operators in the period up to November 2009. The following subsections focus on processes after 2009, although there was a significant amount of similarity.

Types of surveillance events

The SPM outlined the following types of surveillance:

• scheduled audits (using a systems audit approach)
• special audits (conducted in response to an assessment of the operator’s risk profile or other safety intelligence)
• spot checks (or product inspections such as ramp checks, en route inspections, port inspections or checks of approved testing officers).

The CSM outlined a similar set of ‘surveillance events’, including:

• systems audits
• health checks (which were similar to systems audits but reduced in scope and duration)
• post-authorisation reviews (conducted within 6–15 months after initial authorisation)
• operational checks (such as site inspections, ramp checks, en route checks, manual reviews or interviews with key personnel).

System audits, health checks and post-authorisation reviews were described as level 1 surveillance events, which meant they were structured, forward-planned and larger in nature. Level 2 events were significantly shorter in duration, and were described as generally being compliance assessments used to verify the process in practice.

Use of periodic assessment tools

Since October 2000, CASA used questionnaire-based tools to assess each operator on a regular basis. Up until 2012, it used the safety trend indicator (STI), which consisted primarily of a series questions requiring yes or no answers about aspects of an operator’s activities and organisation. From mid 2012, it used the authorisation holder performance indicator (AHPI). The AHPI contained a smaller number of questions and used rating scales with word pictures.

The purpose of both the STI and the AHPI were to provide an overall assessment of an operator, which could then be used to help determine surveillance priorities. The tools were required to be completed about every 6 months by an inspector familiar with the operator. If no surveillance or other oversight activity had recently occurred, the inspector was encouraged to make contact with the operator prior to completing the tool.

Frequency of surveillance activities

From 2005 to 2012, the specified frequency of surveillance activities was outlined in the general aviation (GA) surveillance planning matrix. Smaller and less complex GA operators were subject to the ‘functional surveillance’ approach, which did not require systems-based audits. For example, small passenger charter operators did not have a specified audit frequency but required one site visit every 3 years. Other surveillance activities, such as in-flight surveillance or ramp checks, were to be conducted on an ‘opportunity basis only’. Special audits or additional surveillance activity could be planned if there were indications of elevated risk associated with the operator from an STI or other sources.

Under the CSM (from July 2012), the recommended frequency of surveillance activities for a small passenger charter operator was one level 1 health check every 12 months and one level 2 operational check every 12 months. The status of each operator was regularly reviewed, and if required additional surveillance activity would be initiated.

Scoping of surveillance activities

The SPM stated an audit’s scope played a vital role in the development and conduct of a successful audit. It provided guidance for scoping an audit, which involved inspectors reviewing:

• the operator’s previous surveillance and entry-control history (such as requests for corrective action and observations)
• other safety information (such as incident reports or comments from the assigned auditors)
• organisational changes (such as changes or expansion to operations, introduction of new aircraft or equipment, introduction of new procedures, growth or decline in resources, introduction of new staff, changes in key personnel, change in operating environment and introduction of new routes).

Inspectors were provided with a ‘surveillance planning and scoping form’ and guidance for completing the form. The form included sections for:

• previous surveillance / entry control history (including the date of the last audit, elements from the scope of the last audit and matters to note)
• other safety information (including date, source and details)
• organisational changes (including type of change, effective date and how it affects the scope).

The guidance indicated the first section should include significant findings from previous audits that required follow-up and issues from entry-control activities that needed resolution. The final section of the form listed a series of elements to be examined and matters requiring attention.

The CSM provide less guidance than the SPM regarding audit scoping, but still referred to the scoping form. CASA personnel advised the ATSB that (in recent years up to 2017) the scoping form was not commonly used.

The CSM stated that, following a level 1 surveillance event, inspectors were to carry out a control effectiveness review to determine the effectiveness of the authorisation holder’s controls for each of the system risks that were assessed during the surveillance event. The resulting mitigated risk rating formed a system risk profile (SRP). Sky Sentinel stored the results of all system risk assessments, which could be used when scoping future surveillance events. CASA advised that SRPs were not required to be developed following a level 2 surveillance event. CASA personnel noted that utilisation of the SRP process was low.

Associated with the CSM, CASA defined a common set of systems and elements in order to build up a surveillance picture over time and compare authorisation holders. The manual stated:

Taking into consideration the size and complexity of an individual authorisation holder’s operation, all systems and elements must be assessed in a timely manner. As not all system risks are applicable to all authorisation holders, an inspector’s judgement should be used in identifying the most appropriate system risks for which the effectiveness of an authorisation holder’s control is to be assessed…

Within Sky Sentinel, CASA inspectors could select the desired systems and elements to be examined in a surveillance event, and prepare worksheets using a bank of standard questions or questions they developed themselves.

In its AO-2009-072 (reopened) investigation report, the ATSB stated:

… surveillance is a sampling exercise, and each audit cannot examine every aspect of an operator’s activities. In addition, for charter and aerial work operators, CASA did not have the resources to audit each system element within a defined period of time. Therefore, CASA needed to have a sound approach for deciding what to examine in each audit.

With the introduction of the Surveillance Procedures Manual (SPM) in November 2003, CASA’s procedures and guidance for scoping audits required inspectors to consider information such as the results of previous audits, known organisational changes and other known safety information (such as incident reports). All of these are highly-relevant types of information to consider…

However, the use of previous audit findings and incidents reports is largely a reactive approach. Considering organisational changes can be both reactive and proactive, depending on the nature of the change. Another proactive approach, not included in CASA’s procedures and guidance, is to formally consider the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards…

Even though the SPM provided no formal guidance to consider the nature of an operator’s operations when scoping audits, it is possible CASA inspectors were informally considering such aspects. However, the inclusion of appropriate, formal guidance material about proactively scoping audits based on the inherent threats and hazards involved in an operation would provide additional assurance that audits focussed on the most relevant system elements…

The AO-2009-072 (reopened) findings included the following safety issue (AO-2014-190-SI-14):

The Civil Aviation Safety Authority’s procedures and guidance for scoping an audit included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.

CASA’s response to this safety issue in August 2017 included:

In the preparation process, inspectors are required to review a range of information—including the authorisation holder's policy and procedures manuals—and identify specific areas and risks to be assessed or reviewed. The information, data and history known about the authorisation holder assists in determining the scope and depth of each surveillance event.

CASA has developed safety risk profiles for a number of sectors of the aviation industry, and is continuing to develop safety risk profiles for the remaining sectors. These sector safety risk profiles enable a shared understanding between CASA and industry of hazards that sector participants must address in order to manage their risks and enhance safety outcomes for the sector. CASA is working to enhance the use of sector safety risk data to inform the scoping of surveillance activities.

CASA is currently developing and implementing a National Surveillance Selection Process (NSSP), which will be an enhanced systematic approach to the prioritisation of CASA's surveillance activities…

In November 2017 ATSB acknowledged that CASA’s surveillance processes had undergone significant evolution since 2009, and that it was continuing to review and develop its surveillance processes. The ATSB also noted that it would review CASA’s oversight processes since the introduction of the CSM in 2012 during the course of other investigations (as has occurred during the present investigation).

Oversight of Wyndham Aviation and its key personnel

Overview

For the operator involved in the 10 January 2017 accident, the main assessments relating to the operator’s AOC and key personnel were:

• approval of the initial AOC in June 2009
• approval of the initial chief pilot in June 2009
• approval of the subsequent and ongoing chief pilot in September 2010
• reissue of the AOC in June 2012
• reissue of the AOC in June 2015.

The main surveillance activities conducted were:

• investigation of a complaint in October 2009
• scheduled site inspection in February 2011
• scheduled site inspection in March 2015.

As far as could be determined, there were no ramp checks, spot checks or other surveillance events conducted from July 2009 until the accident on 10 January 2017.

CASA personnel advised that this level of surveillance was consistent with that generally applied to operators of a similar size and complexity conducting passenger charter operations. They also advised that the recommended amount of surveillance activity in the CSM was unrealistic for a small charter operator, given their resources.

CASA inspectors completed three safety trend indicators (STIs) on the operator during the period from July 2009 until mid 2012, and seven authorisation holder performance indicators (AHPIs) from mid 2012 until the end of 2016. None of the scores on these tools indicated a need for elevated surveillance activity on the operator.

Investigation of a complaint in 2007

In 2007, prior to the approval of the operator’s initial AOC for Wyndham Aviation (based at Agnes Water), the organisation Sky Dive 1770 was conducting similar operations, with the person who was Wyndham Aviation’s chief pilot from June 2010 to 2017 being the pilot. The organisation did not hold an AOC.

In late 2007, CASA received a complaint from a concerned pilot regarding the type of operations conducted by Sky Dive 1770. The provided information included a video of a flight conducted on 4 October 2007. CASA documentation stated that this flight involved ‘aerobatic and erratic’ manoeuvres with three passengers on board.

CASA subsequently identified that, in May 2007, two business partners commenced commercial sightseeing flights based at Agnes Water under the operating name Sky Dive 1770, with one of the partners (who held a CPL) conducting the flights in a Cessna 172. (This pilot was the chief pilot of Wyndham Aviation at the time of the January 2017 accident.) The pilot and his business partner stated that they had entered a verbal agreement with another operator to conduct these operations under that operator’s AOC.

After investigating the complaint, CASA suspended the pilot’s PPL and CPL, and required him to undertake an examination and flight test to demonstrate that he continued to possess appropriate aeronautical knowledge and skills. In August 2008, after the pilot completed the examination and flight test, the licence suspension was lifted. CASA documentation indicated that the pilot was informally counselled regarding his actions, and it was noted that he appeared to have learned his lesson and demonstrated a positive attitude to compliance.

Meanwhile, in accordance with its policies, CASA had referred the matter to the Commonwealth Director of Public Prosecutions. In October 2008, the pilot was charged with six offences, including conducting commercial operations without an AOC, giving instruction without holding an appropriate rating, failing to record aircraft total time in service on a maintenance release, failing to record details of each flight in a logbook, reckless operation of an aircraft, and conducting aerobatic manoeuvres outside the provisions of an aircraft’s flight manual. In July 2009 the pilot pleaded guilty to the first four charges and the other two charges were withdrawn by agreement.^[51]

Assessment and approval of initial AOC and chief pilot (2008–2009)

In early 2008, the two business partners of Sky Dive 1770 purchased Wyndham Aviation Pty Ltd, an organisation based in Western Australia that held an AOC to conduct passenger charter operations in Beech 58, Cessna 182 and Cessna 206 aircraft. Although its AOC did not expire until July 2008, that organisation did not have a chief pilot at the time and therefore could not conduct operations.

The new owners (and directors) of Wyndham Aviation advised CASA of the purchase and their intention to submit applications to renew the AOC and appoint a chief pilot. They stated their intention was to conduct passenger charter (sightseeing) operations for backpackers in Cessna 172 aircraft based at Agnes Water, which would involve landing on beaches.

In October 2008, the directors submitted an application to reissue the AOC, an application to appoint a chief pilot, an application to appoint a HAAMC, and changes to its Operations Manual. The person nominated as the chief pilot candidate was the pilot who was a director (and the pilot who was the subject of the complaint in late 2007). CASA documentation indicated that he was found to be unsuitable for the position at that time because enforcement action associated with the 2007 complaint was still in progress.

In April 2009 the operator submitted a chief pilot application that nominated a different person for the position (who had previous chief pilot experience). CASA approved the operator’s initial AOC and chief pilot in June 2009.

At that time, the operator’s other pilot was the pilot who was a director. He had applied to CASA to be the HAAMC in May 2009 (although was not assessed by CASA for that position at that time). When Wyndham Aviation commenced operations in late June 2009, he performed the roles of HAAMC, office manager and senior line pilot and he was actively involved in managing the operator’s operations.

Investigation of a complaint in 2009

In October 2009, CASA received a complaint from an industry association regarding the advertising on the website for the organisation 1770 Air Adventures, which was a business name of the operator. The advertising indicated that the operator conducted ‘limited aerobatic’ flights with three passengers in Cessna 172 and Fuji FA-200 aircraft and ‘aerobatic’ flights with one passenger in Fuji FA-200 aircraft.

CASA officers visited the operator and spoke to the initial chief pilot and the pilot who was a director. CASA records indicated that the operator’s personnel were advised about the requirements for aerobatic flights, and the operator’s personnel provided assurances that all flights were conducted in accordance with regulations and the flight manuals of the aircraft operated. In addition, they advised CASA that photographs on the web site had been manipulated to appear more dramatic than actual flights, and they included photographs taken prior to the previous investigation involving the pilot who was a director in late 2007.

CASA’s files on the operator indicated that, during the 2009 investigation, the operator’s personnel advised CASA officers that passenger charter flights to the Middle Island ALA did not carry any of the passengers’ equipment on board the aircraft. Instead, this equipment was transported by an amphibious vehicle, so there were no issues with overloading or carriage of dangerous goods.

Given the assurances provided by the operator’s personnel, CASA concluded there was insufficient evidence to pursue the complaint any further.

Assessment of a chief pilot application in 2010

In November 2009, the pilot who was a director advised CASA that he and the operator’s other director were having difficulties with aspects of the initial chief pilot’s behaviour (unrelated to the conduct of flight operations). Accordingly, the directors submitted a chief pilot application form, nominating the pilot who was a director as the candidate.

CASA’s files on the operator indicated that from December 2009 to January 2010 the suitability of the chief pilot candidate was considered with regard to the previous enforcement action undertaken in 2007–2009. A CASA flying operations inspector (FOI) stated that the candidate had responded positively to the licence suspension and court action, and had realised the importance of regulatory compliance. The inspector also noted that because the candidate was one of the operator’s directors ‘he would seek to be particularly compliant’ as a chief pilot. The FOI stated that progressing the application would be in the best interests of the operator and CASA.

The CASA FOI sought advice from CASA’s legal section regarding whether there was a minimum time period after the conclusion of enforcement action before a candidate could be considered for a chief pilot position. The answer stated there was no prescribed limit, and the assessment should be based on a range of factors. Given the situation, CASA agreed to allow the candidate’s application to be progressed.

The initial chief pilot resigned from the operator in June 2010, at which point the operator was required to cease operations. CASA conducted an assessment of the new chief pilot candidate in July 2010. At that time the candidate was found to be unsuitable because his answers to various questions regarding the operator’s Operations Manual and some regulatory requirements was ‘well below the level expected of a chief pilot’. CASA recommended the candidate undertake extensive preparation prior to another assessment.

The pilot and director who was the chief pilot candidate submitted various Operations Manual amendments in August 2010, and advised that he had been studying with the chief flying instructor of a flying school. CASA conducted a second assessment of the candidate in September 2010, and he was then approved as the chief pilot.

Scheduled site inspection in 2011

In February 2011, CASA conducted a scheduled site inspection of the operator. The inspection was effectively an audit with a very limited scope, and it was conducted by one FOI. It involved a review of several sections of the Operations Manual and a 1-day site visit, which included an interview with the chief pilot and a review of various operational records. The stated areas of interest included pilot flight and duty time records, CAO 20.11 proficiency checks, approvals from stakeholders for landing sites, and maintenance releases.

The inspection report noted that overall the operator had adequate facilities, equipment and aircraft. It also noted that the chief pilot appeared to be appropriately qualified and carrying out duties to an acceptable standard, and that he demonstrated willingness and a ‘mature acceptance of a need to improve’ any identified deficiencies.

The report included four findings; three requests for corrective action (RCAs) and an observation.^[52] Two of the RCAs and the observation related to maintenance records and documentation, but there was no indication that required aircraft maintenance had not been conducted. The other RCA related to flight crew records. The findings included:

• the hours flown for each day was not entered on the maintenance release for several days (although the progressive total was entered) (RCA)
• portable ELBs carried on the operator’s aircraft were not receiving a monthly inspection as required by the ELB manufacturer (RCA).

The report described the findings as minor in nature, but noted that they highlighted ‘a need for better commitment to process and supervision of maintaining accurate records’. The report also noted that the operator had proactively addressed the identified deficiencies by the time of the inspection’s exit meeting.

In addition, the 2011 inspection report noted that even although the chief pilot had applied to be the HAAMC in 2009 and had been acting in that role, he had not yet been assessed by CASA for that role. In 2019, CASA advised the ATSB that, as far as it could determine, the chief pilot was never assessed for the position of HAAMC. It also advised that the position of HAAMC did not require the issue of an approval or instrument, and there was no policy to formally assess and accept a HAAMC candidate until about 2014.

In CASA’s file associated with the site inspection, there were no scoping form, worksheets or other documents that identified the specific aspects of each element that was being assessed during the inspection.

Reissue of AOC and assessment of a complaint in 2012

In May 2012, the operator applied to have its AOC reissued for another 3 years. On 19 June the oversighting office (Eastern Region) stated that it had no objections to the operator’s AOC being reissued for 3 years. CASA subsequently identified that the operator had not formally responded to the RCAs issued in August 2011. This was concluded to be a minor issue that should not preclude the issuing of the AOC.^[53]

In addition, in June 2012, CASA received a confidential complaint from a resident of Agnes Water. The complainant alleged that the operator’s chief pilot routinely conducted aerobatic manoeuvres in a non-aerobatic aircraft when flying backpackers to a beach camp site. It noted that such flights were common knowledge in the area, and the complainant stated they had received feedback that many passengers on these flights were ‘genuinely frightened’. The complainant also noted that passengers were apparently not allowed to film the flights, due to a previous warning from CASA. The complainant provided a video, taken from the ground, of a small aeroplane conducting various manoeuvres.

In CASA’s files on the operator, CASA personnel noted that it had insufficient resources and time remaining before the expiry of the AOC (30 June 2012) to conduct a full investigation of the complaint. They considered whether they should renew the AOC for a shorter time period than the standard 3 years. It was noted that it would be very difficult from the video to determine the aircraft registration and operator and the manoeuvres were ‘not excessive’. It was also noted that the operator’s chief pilot had a prior history of conducting aerobatic manoeuvres in non-aerobatic aircraft (see Investigation of a complaint in 2007). Ultimately, CASA personnel concluded that they could reissue the AOC for 3 years and deal with any matters that might arise from an investigation through an enforcement process. The AOC was reissued on 29 June 2012.

On 10 July 2012, CASA completed its assessment of the video. It concluded that the aircraft registration could not be determined, although it appeared to be a high-wing aircraft. It also concluded that the video did not provide sufficient detail of excessive flight attitudes for a Cessna 172 that would require further investigation at that time. However, if a CASA team was programmed to be in the operator’s area, and if time permitted, they would be asked to view flights to verify the assessment.

In May 2013, the author of the June 2012 complaint wrote to CASA, noting that they had not received any feedback on their previous complaint. They stated that the chief pilot was still routinely putting his aircraft in a steep dive during flights so passengers would float around the aircraft. CASA responded to the complainant, and noted it had not previously provided a response because the complainant had stated they were happy to leave the matter in CASA’s hands. It also noted that, in relation to the initial complaint, CASA was unable to take the matter further because ‘there was no clear evidence of a breach of civil aviation regulations’ in the video.

A note on CASA’s files on the operator in December 2013 stated that an FOI had viewed a social media site and identified some ‘unprofessional behaviour’ but no regulatory breaches. CASA later advised the ATSB that CASA management had suggested the FOI review the social media site to see if there was further evidence to substantiate the complaints from the resident of Agnes Water. The inspector had identified some questionable manoeuvres but was unable to determine whether there was a breach of legislation.

Schedule site inspection in 2015

In March 2015, CASA conducted a scheduled, level 2 surveillance event (site inspection) of the operator. The inspection team included two FOIs and an airworthiness inspector (AWI). Prior to the inspection, CASA had noted that the operator had now increased the size of its operation to two aircraft for its passenger charter operations (with the addition of VH-WTQ) and it was transporting up to 20 passengers a day with beach landings.

The inspection involved a 1-day site visit, which included an interview with the chief pilot, a review of various operational records, an inspection of both the operator’s Cessna 172 aircraft and an observation of a briefing provided to a group of passengers prior to them being transported to a beach ALA. The stated scope of the inspection included aircraft load control, AOC operations, operational standards, crew scheduling and various airworthiness aspects.

The inspection report noted that, overall, the operator’s operations were standardised and not complex. It also noted that although the inspection ‘did not reveal an AOC operating in a manner that raised any immediate safety concern there existed a potential for the AOC drifting into a pattern of non-compliance with regulations’. In addition, it noted that the chief pilot, as the owner and manager of a business, had a significant workload and limited time to focus on the responsibilities of the chief pilot and HAAMC. The report also noted that the chief pilot had limited knowledge of the duties and responsibilities outlined in the Operations Manual for the HAAMC position.

The report included nine findings; five non-compliance notices (NCNs)^[54] and four observations. Four of the NCNs and one observation related to maintenance records and documentation, but there was no indication that required aircraft maintenance had not been conducted. The other NCN and one observation related to flight crew records. The findings included:

• the progress total of the maintenance release for VH-WTQ was the hours meter reading and not the TTIS (NCN, see also Appendix A)
• the operator used ‘standard’ load sheets to calculate take-off weight and maximum allowable fuel and these did not include the use of the actual weights of passengers and cargo (observation).

The inspection report was completed in May 2015. The operator promptly responded in May 2015 with action taken or proposed to address all of the findings, including the observations. The response to the observation about standard load sheets stated that the operator would ‘now weigh all passengers and luggage’ and use this data for take-off weight calculations.

In CASA’s documentation associated with the site inspection, there were worksheets developed for the examination of maintenance records. There was no scoping form, worksheets, or other documents that identified the specific aspects of each element that was being assessed in relation to flight operations elements.

Oversight activities from May 2015 until the accident

In May 2015, the operator applied to have its AOC reissued for another 3 years. No concerns were expressed by CASA personnel, and the AOC was reissued on 17 June 2015 for 3 years.

In August 2015, the operator applied to have an alternative chief pilot approved to fill in the role when the chief pilot was on leave. The applicant was a flight instructor who conducted aeroplane flight reviews for the operator’s pilots, and had chief pilot experience. The application was approved by CASA in September 2015.

In late 2015, CASA received a complaint about occupational safety and aviation safety aspects regarding photographs on a social media site showing people climbing on top of the operator’s Cessna 172 aircraft. CASA wrote to the (regular) chief pilot to advise him of the complaint, noting that promotional material of this nature could be perceived as having an impact on the airworthiness of the aircraft, and indicating that CASA would investigate if similar concerns were raised again.

The AHPI completed in December 2015 noted that Wyndham Aviation was an established operator but recent surveillance and reports from third parties had raised awareness of the need to conduct another site inspection of the operator the following year. The two AHPIs conducted on the operator during June and November 2016 did not identify any concerns.

Oversight associated with approaches and landings at beach ALAs

When the operator submitted its initial Operations Manual in 2008, CASA required a number of changes. This included procedures for conducting beach landings. These procedures were included in the copy of the revised manual submitted to CASA in May 2009 and accepted by CASA. No changes were made to these procedures prior to the accident.

There was no indication in the 2011 and 2015 site inspection reports and related documentation that aspects associated with the operator’s approaches, landings and take-offs at the beach ALAs were examined. The CASA inspector who conducted the site inspection in 2011 stated that approaches and landings at beach ALAs were not part of the scope of that inspection and were not considered during the inspection. Two of the three CASA inspectors involved in the 2015 site inspection could not recall approaches and landings at beach ALAs being discussed during the surveillance event.

A comment on the June 2016 AHPI stated that beach landing areas were an ‘identified hazard but risk has been managed’. The CASA inspector who made the comment was familiar with the operator’s operations. He advised the ATSB that no new information had been obtained to indicate that the procedures for beach landings had changed from what had previously been accepted by CASA.

CASA personnel noted that, following the accident, they identified that the operator’s Operations Manual did not fully describe the operator’s practices for conducting airborne inspections. They noted that they may therefore have assumed (prior to the accident) that such activities were conducted in accordance with normal industry guidance for precautionary search and landings. If they were not going to be conducted in accordance with that guidance, they would have expected more detail to be included in the operator’s manual (see for example Airborne inspection procedures of another operator ).

The chief pilot advised the ATSB that he had offered on multiple occasions to take CASA inspectors on one of his flights to observe his operations, but CASA had declined. CASA personnel noted that it would have been logistically difficult to observe the operator’s processes for landing at the beach ALAs unobtrusively. They also noted that, if they had observed any flights, it is quite likely that the performance on such flights would have been different to normal operations.

Additional information

There was no indication in the 2015 site inspection report (or related documentation) about whether the topic of aerobatic or near-aerobatic flight was discussed with the operator. The chief pilot subsequently advised that he believed CASA were well aware of the nature of the en route manoeuvres conducted by the operator to provide passengers with additional enjoyment, as it was discussed during the 2015 site inspection, and CASA FOIs had attended the briefing to passengers where he explained the nature of the flights and the permission form.

CASA personnel from the office oversighting the operator advised that during the 2015 site inspection its inspectors did briefly discuss some aspects associated with aerobatics and en route manoeuvres, and made it clear to the chief pilot that the flights had to conducted within the regulatory requirements. However, the conduct of aerobatic or near-aerobatic manoeuvres was not discussed in CASA’s report on the site inspection. There were no records of any discussion with the operator about the manoeuvres.

The chief pilot also stated that the introduction of the passenger permission form for the en route manoeuvres was at the suggestion of CASA. However, CASA personnel disagreed that this was the case.

Overall, CASA personnel stated that no significant concerns were raised about the operator during its STIs and AHPIs, and the operator was never flagged during monthly planning meetings as an operator that required increased surveillance. They advised that, although CASA had received some complaints about the operator, the evidence associated with these complaints was insufficient to warrant an investigation. They also noted that many complaints it received about operators were vexatious or misguided in nature. Without clear evidence indicating regulatory breaches, or corroborating evidence, it was difficult to justify the resources for an investigation.

CASA personnel noted that CASA generally had very little information available about operator’s like Wyndham Aviation to review when considering surveillance activities or scoping surveillance events. For such operators, CASA conducted very few regulatory service tasks other than the reissue of an AOC. In addition, there were generally very few incident reports or surveillance findings available. CASA personnel also noted that the relatively remote location of the operator in this case increased the logistical difficulty of conducting site inspections.

 __________

6. The AFR assessment form submitted to CASA did not indicate (and was not required to indicate) if a partial and/or total engine power loss was simulated or if engine failure procedures were reviewed. Further, it did not indicate if a precautionary search and landing was demonstrated by the pilot.
7. Flight time in aviation is normally represented in decimals of an hour rather than minutes; 0.1 flight hours is 6 minutes.
8. Maintenance release: an official document, issued by an authorised person as described in Regulations, which is required to be carried on an aircraft as an ongoing record of its time in service (TIS) and airworthiness status. Subject to conditions, a maintenance release is valid for a set period, nominally 100 hours TIS or 12 months from issue.
9. The maintenance release had 0.3 hours flight time documented after 4 January 2017, with a documented TTIS of 6,838.7 hours. The documented date appeared to be 10 January, then amended to 6 January. There were no flights recorded on the GPS unit after 4 January (other than the accident flight), and no flights documented in the pilot’s logbook. The chief pilot also stated he did not conduct any flights during this period. Consequently, the 6 January entry was considered to be erroneous.
10. Civil Aviation Regulation (CAR) 42B (Maintenance schedule: CASA maintenance schedule) stated that the certificate of registration holder could maintain a class B aeroplane in accordance with CASA’s maintenance schedule. Class B aeroplanes included all aeroplanes except transport category aeroplanes used for regular public transport operations.
11. The chief pilot made most of the entries on the aircraft’s maintenance releases to certify that a daily inspection had been completed prior to the first flight of the day.
12. The requirements for oil and oil filter changes between periodic inspections was specified in Airworthiness Directive AD/ENG/4, which required them to be done at intervals as published by the engine manufacturer. Lycoming service bulletin SB480E stated that, for the engine type fitted to VH-WTQ, oil and oil filter changes were required every 50 hours or every 4 months, whichever came first. The oil and oil filter changes could be conducted by a pilot.
13. According to CAR 47, (Maintenance release to cease to be in force) a maintenance release ceased to be in force if any required maintenance specified in part 1 of a maintenance release was not completed. The operator’s Operations Manual also stated that a pilot must review the maintenance release before commencing a flight and, if there is outstanding maintenance, ‘the aircraft must not be flown until a person authorised to conduct that maintenance clears the item.’
14. Under CAR 139, (Documents to be carried in Australian aircraft) the maintenance release was required to be carried on the aircraft.
15. Tests conducted by the United States’ National Transportation Safety Board on a similar Cessna 172K aircraft found that selecting the fuel selector to OFF with the engine at full power would result in the engine stopping after 9 seconds (see Accident number ERA14FA428).
16. Skid: an aerodynamic condition, during a turn, where the tail of an aeroplane moves away from the centre of the turn or tends to follow a path which is outside that followed by the nose.
17. This analysis involved determining the fundamental frequency corresponding to the engine/propeller noise and converting this to revolutions per minute (RPM).
18. The recorded GPS data commenced part way through a flight on 12 November 2016.
19. Secondary surveillance radar relies on an aircraft’s operational transponder transmitting a data signal in response to being interrogated by an air traffic service radar or another receiver (for example, another aircraft’s Traffic Alert and Collision Avoidance System). The radar system determines the aircraft’s position based on the timing of the radar returns. Depending on the type of aircraft transponder, the data signal can provide additional information. The transponder fitted to VHWTQ provided altitude information (Mode C).
20. These were: one quarter 28 L left, 26 L right; half 50 L left and 49 L right; three quarters 62 L left, 60 L right; full 90 L both sides.
21. Each tank had a separate refuelling point. If fuel was only added to one side, this could result in an imbalance, which could be corrected in cruise flight (if required) by moving the fuel selector from the BOTH position to the side with the highest quantity.
22. This reading was taken when the aircraft was on descent and had had a wings-level attitude for a sustained period. A similar reading was observed earlier in the flight when the aircraft had a wings-level attitude and was at cruise height. The readings changed rapidly during turns and other manoeuvres, consistent with the nature of the fuel quantity indicating system (which included a float based in each fuel tank).
23. This amount equated to a fuel burn of 36 L/hour. The Cessna 172M Owner’s Manual estimated the maximum fuel burn at 2,500 ft was about 36 L/hour.
24. The chief pilot also stated that each flight from Agnes Water to a beach ALA (or return) took 7 minutes, for a total duration of 14 minutes. However, a review of the GPS data for VH-WTQ indicated that the total flight time for a return trip was normally about 17.5 minutes and on many occasions also included another short trip of about 2.7 minutes from one beach ALA to the other beach ALA (see Appendix A). Both the chief pilot and the pilot of the accident flight reported that VH-WTQ was the quicker of the operator’s Cessna 172 aircraft.
25. A review of the GPS data for VH-WTQ indicated that, when multiple trips were conducted from Agnes Water to a beach ALA on the same day, there was generally insufficient time to refuel the aircraft at Agnes Water between trips.
26. The MTOW is the maximum allowable aircraft weight at the start of the take-off run.
27. The head of aircraft airworthiness and maintenance control (HAAMC) was required to ensure that aircraft listed on the Air Operator’s Certificate were operated in compliance with the applicable provisions of the Civil Aviation Act, Regulations and Orders. This included the responsibility to update aircraft weight and balance data following any changes to an aircraft’s load data certification.
28. The ATSB used an AVGAS specific gravity of 0.72 kg/L, which is commonly used in general aviation. The operator used 0.71 in its updated sheet but had used 0.72 in its previous load sheets.
29. The sections in the manual that included the ALA register and beach landing procedures were dated May 2009 and they were not listed as being amended in August 2010.
30. This guidance assumes that the precautionary search is conducted in the same direction as the subsequent landing.
31. The chief pilot also reported that he normally used no flap when landing on the beach ALAs, given the long length of the ALAs and that using the flaps increased maintenance requirements. The pilot of the accident flight reported that he normally used full flap when landing.
32. The lowest altitude of each inspection search was determined by averaging the two consecutive GPS data points with the lowest altitudes when the aircraft was abeam or just passed the ALA.
33. ATSB AR-2013-107, Engine failures and malfunctions in light aeroplanes, 2009 to 2014. Available from www.atsb.gov.au.
34. ATSB, 2013, Managing partial power loss after takeoff in single-engine aircraft, Avoidable Accidents Series, No. 3 (AR2010-055). Available from www.atsb.gov.au.
35. The Aeronautical Information Publication (AIP) stated ‘…the turn onto final should be completed by not less than 500FT above aerodrome elevation. This should allow sufficient time for pilots to ensure the runway is clear for landing. It will also allow for the majority of aircraft to be stabilised for the approach and landing.’ The operator’s Operations Manual stated that ‘To assist in ensuring a stable approach, the Company recommends that pilots have the aeroplane configured for landing with all check list actions complete at not less than 500 feet above terrain’.
36. There was one other day when there were flights recorded on the GPS unit but no flights recorded in the pilot’s logbook or on the maintenance release, and three days where there was flights recorded on the GPS unit and in the pilot’s logbook and no flights recorded on the maintenance release.
37. Additional requirements included that, prior to aerobatic flight, all loose articles had to be removed or secured and dual controls removed, aerobatics could not be conducted at night and aerobatics had to be conducted in visual meteorological conditions.
38. Prior to 2014, CAR 155 referred to ‘acrobatic flight’ rather than ‘aerobatic flight’. Although there were changes to some regulations, the general definition and requirements were similar.
39. This requirement did not apply to aeroplane with 10 or more seats.
40. Many studies have also advocated the fitment and use of UTRs in front row seats. However, in the United States, UTRs were only required for front row seats for small aeroplanes manufactured after 18 July 1978.
41. The selected accidents included those where at least one occupant was fatally or seriously injured. The accidents were evaluated to determine the extent to which they were survivable, based on whether one occupant either survived or could have survived if shoulder harnesses or energy-absorbing seats were used. The data suggested that a survivable envelope was defined by impact speeds of 45 kt at 90º angle of impact, 60 kt at 45º angle of impact and 75 kt at 0º angle of impact.
42. BASI became part of the newly-formed ATSB in July 1999.
43. BASI Investigation Report 199802830, Cessna 185E Floatplane, VH-HTS, Calabash Bay, NSW, 26 July 1998. Available at www.atsb.gov.au.
44. Prior to the SEB, Cessna issued Service Newsletter 85-18 in 1985 to advise of the availability of shoulder harnesses. The Owner’s Handbook for Cessna 172M/N aircraft also advised of the availability of UTRs.
45. For example, Beechcraft issued a mandatory service bulletin in 1985 for many of its models of small aeroplanes, and Piper issued a mandatory service bulletin in 1988 for many of its models of small aeroplanes.
46. The AIP also stated that, for passenger-carrying charter operations, the distance from land could not exceed 25 NM.
47. These included two ditchings with four occupants, three with three occupants, four with two occupants and seven with one occupant.
48. A CAR 217 training and checking system was required for regular public transport operators, operators of larger aircraft (with a MTOW exceeding 5,700 kg) and other operators specified by CASA. Such operators were required to provide its pilots with two proficiency checks each year, with the training and checking organisation, check pilots and design of the proficiency checks to be approved by CASA.
49. In accordance with CAO 20.11, pilots of charter or regular public transport aircraft must undertake an annual proficiency test in the conduct of emergency procedures. It consisted of theoretical knowledge and practical demonstration of emergency equipment and procedures which included emergency evacuations, fire extinguishing and use of life jackets and other emergency equipment required for the operator’s flights.
50. ATSB AO-2009-072 (reopened), Fuel planning event, weather-related event and ditching involving Israel Aircraft Industries Westwind 1124A, VH-NGA, 6.4 km WSW of Norfolk Island Airport, 18 November 2009. Available from www.atsb.gov.au
51. Following the accident on 10 January 2017, CASA obtained the pilot’s computer from the Queensland Police Service. CASA identified numerous video files from late 2007 that contained footage of Cessna 172 flights with passengers on board that involved aerobatic manoeuvres and other activities consistent with the video reviewed as the subject of the complaint. A video of a flight conducted during in late 2007 was also published on social media in 2011, and it showed manoeuvres that were clearly aerobatic in nature (such as bank angles of at least 90º).
52. An RCA was issued when there was a failure to comply with regulatory requirements, which necessitated the operator to take corrective or preventive action. An observation was issued to draw the operator’s attention to latent conditions or minor deficiencies that could not be attributed to current regulatory requirements. Operator’s were required to respond to RCAs but were not required to respond to observations.
53. The February 2011 inspection report was completed in August 2011, with a due date of formally responding to the RCAs in September 2011. The operator’s formal responses were received on 20 July 2012 and the RCAs were then acquitted.
54. NCNs replaced RCAs with the introduction of the CSM in 2012. They were effectively the same type of finding.

Safety analysis

Introduction

During the conduct of an airborne inspection of a beach aeroplane landing area (ALA), with the aircraft at about 60 ft above mean sea level (AMSL), the Cessna 172M aircraft lost engine power. After conducting initial checks, the pilot turned left towards the beach. During the continued turn, the aircraft impacted the beach in a significant nose-down and left-wing low attitude and with little or no control.

This analysis will first consider potential reasons for the engine power loss. It will then discuss safety factors associated with managing the risk of an engine power loss during a low-level airborne inspection. It will also consider a range of other safety factors identified during the investigation, relating to maintenance control, aircraft loading, survival factors, organisational factors and regulatory oversight.

The accident involved a passenger charter (air transport) flight and resulted in one fatality and three serious injuries. Although the aircraft involved was a small (four seat) aeroplane, the investigation identified a number of safety factors that highlight important lessons for pilots, operators and regulators.

Engine power loss

Based on the video evidence and the pilot’s recollection, the engine suffered a total and sudden power loss. The aircraft’s maintenance documentation and a post-accident inspection of the aircraft’s engine and related systems did not identify any faults or defects that could explain the power loss. Based on the available information, there appeared to be more than sufficient fuel on board.

Carburettor icing is a potential reason for engine power loss on piston engines, particularly when carburettor heat is not being used. If it occurs it is also difficult to prove because the icing is no longer present after impact. However, in this case, carburettor icing was considered unlikely to have occurred. The sudden and total nature of the power loss was not consistent with icing. In addition, the power setting being used, short duration of the flight and the ambient conditions at the time all indicated that the risk of carburettor icing was relatively low.

The examination of the fuel system identified there was a small amount of water and contaminants present in the fuel strainer bowl. However, no similar contamination was found in the carburettor (or in the fuel in the fuel tanks). Therefore, the fuel strainer appeared to have successfully captured the contamination.

The absence of fuel in the carburettor indicated that some form of fuel starvation occurred (that is, fuel was available on the aircraft but did not get to the engine). However, the reason why there could have been fuel starvation could not be determined. The video footage indicated that, about 80 seconds prior to the engine power loss, there was a momentary reduction in engine/propeller speed. However, this reduction was consistent with the nature of the pitch-down manoeuvre being conducted at that time and it would not cause any later engine power loss.

It is possible that the en route manoeuvres being conducted during the flight briefly unported one of the fuel tanks, resulting in air feeding into the fuel line from that tank. However, all of the available evidence indicates that the fuel selector was selected to both tanks during the flight, and air being fed into the engine from one side should not have led to a total power loss. In addition, the en route manoeuvres stopped about 80 seconds prior to the total engine power loss. Overall, it seems very unlikely that the en route manoeuvres could have introduced sufficient air into the engine from both fuel tanks at the same time, resulting in an engine power loss, particularly one occurring so long after the manoeuvres ceased.

The aircraft manufacturer’s Owner’s Manual included a note stating that under certain conditions a prolonged steep descent could lead to a temporary fuel starvation. However, during the accident flight the descent was not steep, and the circumstances did not match the required conditions for this phenomenon to occur.

In summary, the reason for the engine power loss could not be determined. The most likely explanation is some form of fuel starvation, but the reason for any such fuel starvation could not be ascertained based on the available information.

Significant turn at a low height after engine power loss

Regardless of the reasons why it occurred, an engine power loss should not necessarily lead to very serious consequences, even in a single-engine aircraft. Accordingly, the ATSB examined the pilot’s actions and the operator’s risk controls for managing an engine power loss, particularly during an airborne inspection of an ALA.

The pilot stated that, after the engine power loss occurred, he conducted some basic checks to see if the problem could be rectified. After these checks were unsuccessful, the pilot needed to make a decision about what emergency action to take. His options included:

• turn left slightly and land on the remainder of the beach (heading north)
• ditch the aircraft (either in the sea to the right of his current flight path or in the channel north of the landing area)
• attempt to turn back 180º and land on the landing area (heading south)
• gain height to extend the aircraft’s glide distance and identify a suitable area for an emergency landing.

All of the options were likely to result in at least some level of damage and/or injury. However, with the benefit of hindsight and a detailed consideration of all the available information, the option likely to result in the least damage or injury was to land the aircraft ahead on the remainder of the beach (heading north).

At 1037:38 (4 seconds after the power loss), the aircraft was almost over the beach, with at least 820 m (2,690 ft) of beach available ahead for an emergency landing (from a height of close to 50 ft). If the pilot commenced a landing at that time, he should have been able to touch down at the northern end of the normal landing area, albeit at a higher-than-normal landing speed, or even further down the beach. During the landing roll the aircraft would probably have encountered some areas of uneven terrain (with ruts in the sand), puddles of water and/or areas soft sand, all of which would have been unsuitable for a normal landing. It is possible the aircraft’s nose landing gear may have collapsed, and/or the aircraft nosed over or perhaps even flipped over. However, serious injuries would have been unlikely and fatalities would have been very unlikely.

Standard flight training and guidance for pilots is to land straight ahead, or within 30º either side of straight ahead, following an engine failure or power loss at a low height. Although an emergency landing on the beach straight ahead was the lowest risk option in this case, this may not have been readily apparent to the pilot at the time. The pilot was very familiar with the landing area and its surrounds. However, during the period immediately following the power loss, the full length of beach available to use for an emergency landing north of the landing area and up to the camp site was not visible from the cockpit.

The pilot recalled thinking that if he continued straight ahead, he would end up having to ditch in the channel north of the landing area. He emphasised that he did not want to conduct a ditching because he perceived there was a very high level of risk involved. Although a review of previous ditchings of Cessna 172 and similar aircraft shows that most do not result in fatalities (or even serious injuries), there is undoubtedly some risk involved, particularly if the pilot is not prepared for a ditching and does not have time to prepare. In this case, there was additional risk following a ditching due to the absence of life jackets on board the aircraft, and other factors such as the current (if the ditching was conducted in the channel).

A 180º turn back to the landing area would not have been successful, no matter how well the manoeuvre was conducted. Such a manoeuvre from a low height with no engine power will always result in a collision with terrain. Despite pilots being trained not to turn back if an engine fails soon after take-off, unfortunately such turnbacks often still occur, even with experienced pilots.

In this case, the pilot reported that he selected the option to gain height and look for a suitable area for an emergency landing. This ultimately involved a continuous left turn towards the beach, with the resulting heading being about 90º left of the aircraft’s current heading. However, it is not clear that this manoeuvre was his initial intention. Prior to commencing the left turn, the pilot conducted a slight right turn, which took the aircraft further out over the water and away from the beach, while still heading north. The right turn may initially have been associated with the pilot giving the aircraft more lateral spacing to conduct a turn back towards the south, and during this manoeuvre he realised that this was not going to be possible. At this point, he thought simply getting the aircraft back to the beach was the best outcome that could be achieved.

Regardless of his initial intention, a continued turn from a very low height with no engine power would inevitably result in a collision with terrain, either in controlled flight with a significant bank angle or preceded by a stall and loss of control. In this case, the aircraft was close to the stall speed towards the end of the turn and the aircraft may have stalled just prior to impact. Regardless of whether the aircraft stalled, the aircraft impacted terrain with little or no control and a significant descent rate.

If the pilot had selected some or full flap prior to or during the left turn, he would have been able to extend his glide distance further and reduce the aircraft’s stall speed, and potentially the aircraft’s speed at impact.^[55] However, given the location of the aircraft when he commenced the left turn, and the nature of the surrounding terrain, it is very unlikely that a collision with terrain could have been avoided.

Stress, time pressure and surprise

There was no evidence to indicate that the pilot’s response to the emergency was affected by fatigue, a medical issue or similar factors. However, the pilot was making decisions under a high level of stress and time pressure. A substantial amount of research has shown that people often do not make optimal decisions in such situations.

Some commonly reported effects of stress and/or time pressure include attentional narrowing, with people searching fewer information sources (Staal 2004), and focusing on cues that are perceived to be the most salient or threatening (Burian and others 2005, Wickens and Hollands 2000). Working memory and the ability to perform complex calculations is impaired (Burian and others 2005), and the ability to retrieve declarative knowledge (or facts) from long term memory is affected (Dismukes and others 2015). People can also act more impulsively (Dismukes and others 2007).

Research has shown that experts under time pressure often make recognition-primed decisions rather than systematically compare all the available options (Klein 1998). That is, experts intuitively evaluate a situation and select a solution based on their experience. In some cases they may need to mentally simulate whether the solution will work, and if not then either refine the solution or consider other options. Although this recognition-primed approach is generally successful when a person has relevant expertise in making the type of decision, high levels of stress and time pressure can still reduce the effective search for information and affect the ability to mentally evaluate a solution.

If a person does not have the relevant expertise to make recognition-primed decisions and instead attempts to identify and compare options, stress and time pressure will usually have more influence. In addition to the effects discussed above, a person will generally consider fewer alternatives, and not be as systematic when evaluating alternatives (Dismukes and others 2015, Staal 2004).

Related to stress and time pressure are the concepts of surprise and expectancy. In general, if a person is not expecting an emergency or abnormal event to occur, their response to the situation will often be slower and more variable. This effect has been demonstrated in several research studies involving experienced pilots (for example, Casner and others 2013, Landman and others 2017).

The exact cognitive mechanisms that lead to the tendency of many pilots to not land straight ahead following an engine failure or power loss soon after take-off have not been researched in detail. However, in addition to the general effects of stress, time pressure and surprise, there is often probably an influence associated with a pilot knowing that landing straight ahead will definitely lead to some adverse outcomes, but instinctively believing (often incorrectly) that turning may lead to an outcome with no or fewer adverse outcomes. Research has shown that when a person is faced with two options that are framed as losses (or with adverse outcomes), they tend to be risk seeking (Kahneman 2011). That is, rather than selecting a loss option that is certain but has a low loss magnitude, people will tend to select a loss option with less likelihood but higher loss magnitude. However, research on the extent to which time pressure influences the tendency to be risk seeking for losses is unclear, and there has been very little research that has examined the influence of this risk seeking tendency in emergency situations.

In summary, the pilot was undoubtedly faced with a very difficult situation. He had limited options available, all of which were likely to result in adverse consequences, and very limited time to make a decision. Ultimately, his decision to gain height over the water and then conduct a significant, continued left turn towards the beach was probably not the option with the lowest risk. However, his decision making during the event was consistent with the known effects of stress and time pressure on human performance. It was also consistent with the limited risk controls put in place by the operator to manage the risk of an engine power loss during an airborne inspection of an ALA.

Airborne inspection procedures and practices

The beach surface on Middle Island that the operator used as an aerodrome landing area (ALA) changed with tidal action. Accordingly, it was important for the operator to have processes in place to inspect the landing area prior to the first landing of the day to ensure it was suitable. However, the operator’s practices and procedures for conducting airborne inspections, and for managing the risk of an engine failure or power loss during these inspections, were problematic for several reasons. These included:

• The operator’s normal practice was to conduct these inspections at a very low height, between 50–100 ft, when heading north abeam the landing area and up to crossing the Jenny Lind Creek inlet. During the initial part of the inspection, the pilots always had the option of landing straight ahead on the beach if there was an engine failure or power loss. However, for the latter part of the inspection, there was no suitable land ahead for an emergency landing within 30º either side of straight ahead. Therefore, pilots would have been required to ditch the aircraft or conduct a significant turn to reach land (some of which was potentially unsuitable for an emergency landing). Ditching was the only option available towards the end of the inspection.
• The inspections were conducted at normal cruise speed with no flap selected, and often downwind. The resulting groundspeed (in this case 230 km/h) reduced the potential effectiveness of any visual search, and also increased the general risk associated with low flying.
• The procedures for conducting an airborne inspection were not clearly specified in the Operations Manual. Although both of the operator’s pilots appeared to have a common understanding of how the task was conducted, clearly specifying the procedures (and the hazards associated with the procedures) would have provided them the opportunity to review their practices and consider their suitability. The operator’s practices were also significantly different to general industry guidance for a precautionary search and landing (in terms of height, configuration and number of inspections). Clearly stating the procedures would have also provided more opportunity for other parties, such as the regulator or temporary pilots, to understand how the task was normally performed and provide feedback on the suitability of the procedures.
• There were no clearly specified or understood emergency procedures for responding to an engine failure or power loss at some stages during an airborne inspection. As previously noted, human performance is quite vulnerable to error when people are performing tasks under stress and time pressure. Such errors can be significantly reduced for emergency situations if pilots are provided with clear emergency procedures and regularly practice the procedures, or at least regularly brief or rehearse the required actions. In this case, clearly specified and rehearsed emergency procedures could have included decision points for when it was appropriate to land straight ahead on the beach, conduct an emergency landing on other terrain or conduct a ditching. If a ditching was the most suitable alternative, prior preparation for a ditching, including equipping the aircraft with life jackets, should have been considered.

Engine failures and power losses are rare events, but they need to be planned for, particularly during commonly conducted activities. Based on comments from the chief pilot and the pilot of the accident flight, it appeared that the operator had not systematically considered the risk of an engine failure or power loss during an airborne inspection. Had the operator conducted a risk assessment, it should have identified the problem associated with the limited options available for responding to an engine failure or power loss in the later stages of an inspection.

The operator could have introduced a number of options to reduce the risk, similar to what another charter operator that routinely conducted beach landings had done. For example, the operator could have conducted the inspections such that a beach landing area was always available in the event of an engine failure or power loss. More specifically, inspections could have been conducted to the south, or the landing area could have been moved further south, so that a beach landing was always available during an inspection conducted to the north. In addition, the operator could have provided suitably-trained personnel based at the operator’s camp site to conduct a ground inspection of the landing surface prior to the aircraft arriving, and organised to have these personnel in radio contact with the operator’s pilots.

Furthermore, the minimum height required for an airborne inspection could have been carefully reviewed. Although the chief pilot and the pilot of the accident flight reported that they needed to be at a low level to see cues such as sand balls, it is worth noting that the pilot who conducted operations in late 2015 did not believe that such a low height was required. Conducting the inspections at a slower speed may also have meant that they would have been effective at a greater height.

If none of these options were introduced to change the way the airborne inspections were conducted, the operator could have at least introduced clear guidance on decision points and emergency response actions, and required pilots to self-brief or mentally rehearse those response actions prior to the inspection. It could also have recognised that there was a need to be prepared to conduct ditchings, and ensure that its pilots were prepared to conduct the manoeuvre if required, and the aircraft were equipped with life jackets and passengers were appropriately briefed on their use.

In summary, the operator’s practices for conducting an airborne inspection of the Middle Island ALA placed its pilots in a very difficult situation in the event that an engine failure or power loss occurred during the manoeuvre. Towards the end of their normal inspection, they were placed in the unnecessary position where all the emergency response actions were significantly problematic, with no clear guidance as to what action to take. This created the potential for pilots to not select the lowest risk option when under stress and time pressure. Overall, the operator’s risk controls did not effectively manage the risk of an engine power loss during airborne inspections of the ALA.

Precautionary search and landing guidance

Pilots are provided with training and guidance for conducting precautionary search and landings, and this guidance is generally quite consistent in terms of the minimum height, configuration and number of passes to conduct at different heights.

The ATSB notes that Civil Aviation Safety Authority (CASA) has not provided any formal guidance material regarding the conduct of precautionary search and landings. This should not generally be problematic if there is widespread industry agreement on the procedure. However, it is worth noting that the regulator’s Flight Instructor Manual recommends demonstrating the search at 100 ft, with no other heights mentioned. This could be misinterpreted as indicating that 100 ft is an appropriate height to conduct the first pass of a precautionary search and landing procedure, which is inconsistent with general industry guidance information.

A more significant concern is that none of the guidance material on precautionary search and landings reviewed by the ATSB specifically discussed the importance of considering the risk of an engine failure when conducting the procedure. Pilot training and guidance emphasises the importance of considering engine failure or power loss soon after take-off, because of the significant risk associated with such a scenario due to  the low height and limited performance of the aircraft. The same risk also applies to any other manoeuvre conducted at a very low height, including a go-around / missed approach or a precautionary search and landing.

The ATSB recognises that, in many cases, a precautionary search and landing is being conducted in the context of an abnormal or emergency situation. It may also be the case that many pilots would intuitively consider the risk of an engine failure when conducting precautionary search inspections below 500 ft. Nevertheless, it would be useful and important to enhance the guidance, and advise that conducting precautionary search inspections at a low height should be considered the same as a take-off situation in terms of the risk of an engine failure, and that prior planning and preparation for such a scenario should be undertaken. This would be relevant to all situations, but particularly relevant to situations were pilots were conducting precautionary search and landings at the same landing area on a regular basis.

The extent to which the lack of specific guidance for considering the risk of an engine failure during a precautionary search and landing had an influence on the development of this accident is unclear. The pilots both had significant experience and were aware of the general guidance on precautionary search and landings. However, they had adapted their practices at Middle Island to be different to that recommended in general industry guidance material.

Upper torso restraints

A substantial body of research has demonstrated that wearing upper torso restraints (UTRs) in small aircraft significantly reduces the severity of injuries compared to wearing only a lap belt. In particular, UTRs reduce the risk of head, neck and upper body injuries, associated with the person’s upper body flailing forward, and potentially striking seats, the side of the aircraft or other objects. Many studies have concluded that the single biggest improvement that could be made to crashworthiness in small aircraft is the fitment of UTRs. Accordingly, the United States’ Federal Aviation Administration (FAA) mandated that all small aeroplanes manufactured after December 1986 had UTRs fitted to rear seats (with a similar requirement for helicopters manufactured after September 1992).

The proportion of the Australian small aeroplane fleet manufactured before December 1986 is gradually decreasing, but even now a significant proportion of the fleet being used for passenger transport operations was manufactured before this date. Although kits are available to retrofit UTRs to many small aircraft, a large number of aircraft manufactured prior to the specified dates still have not been retrofitted, even for aircraft used for passenger transport operations, such as Wyndham Aviation’s Cessna 172 aircraft. Despite recommendations from numerous investigation agencies around the world, including in Australia in 1999, there has been no change to the regulatory requirements, even for passenger transport operations.

In this accident, both rear-seat passengers suffered significant neck injuries, and the passenger on the left also received a significant cardiovascular injury and the passenger on the right received a significant head injury. Even though the rear bench seat had separated from the floor structure in overload during the impact sequence, UTRs, if fitted and worn, would still have provided some restraint to the passengers’ upper bodies. It is also noteworthy that the two front seats had also separated from the floor in overload, and the front-seat occupants, who were both wearing UTRs, had less serious injuries than the rear-seat passengers.

Overall, it is very likely that the severity of the rear-seat passengers’ neck / head injuries would have been reduced if they had been provided with and were wearing UTRs. Nevertheless, it is difficult to determine whether the fatal outcome for the left rear-seat passenger would have been prevented with the use of a UTR, given her other injuries. The left side of the aircraft was exposed to higher impact forces than the right side.

Requirements for briefing passengers on the brace position

If UTRs are not fitted for all passenger seats, another intervention that can reduce the risk of injury is to ensure passengers use an appropriate brace position. Adopting a brace position can reduce the impact forces associated with the body flailing and can therefore potentially reduce the severity of injuries during an impact. Although using a brace position with a lap belt is not nearly as effective as using a UTR with a lap belt, an appropriate brace position will still reduce the risk of an injury compared to wearing a lap belt only and sitting upright.

At present, there are no requirements for operators of aircraft with six or less seats to demonstrate or brief a brace position for passengers, or to provide passengers with such information. Although many passengers have been exposed to such information when travelling on large airline aircraft, they may not realise that the brace position is also suitable, and the potential benefits are equally as applicable, to a small aircraft.

In this case, it is difficult to determine whether briefing the rear-seat passengers about the brace position prior to flight would have reduced the severity of their injuries in this case. After the engine power loss, the pilot was experiencing a very high workload and did not have time to provide any advice to the passengers about the impending impact or provide a brace call. The extent to which the rear-seat passengers were aware of the severity of the situation, until immediately prior to impact, could not be determined.

Carriage of life jackets

The operator’s Operations Manual stated that overwater flights were only to be conducted in aircraft with retractable landing gear, which did not include the operator’s Cessna 172 aircraft. The chief pilot also stated that he believed a ditching in such aircraft involved a high risk. However, based on a review of Global Positioning System (GPS) data from VH-WTQ, many of the operator’s flights involved segments conducted such that, if an engine failure or power loss occurred, a ditching was the only option available or (in some cases) a ditching was probably the best option available. These segments included most of the airborne inspections, but also some take-offs and approaches.

Civil Aviation Order (CAO) 20.11 stated that life jackets were required for all charter flights when ‘in the event of a mishap occurring during the departure or the arrival it is reasonably possible that the aircraft would be forced to land onto water’. Accordingly, life jackets were required for the accident flight, given the manner in which the airborne inspection was planned to be completed. In addition, life jackets would have been required for most of the airborne inspections conducted by the operator with passengers on board. They would probably also have been required for some of the operator’s other flight segments, if passengers were being carried. However, the extent to which passengers were carried on most of those flights could not be determined.

The operator did not routinely carry life jackets on board its two Cessna 172 aircraft for flights to Middle Island or Aircraft Beach, and no life jackets were on board VH-WTQ for the accident flight. The absence of life jackets would have reduced the chances of survivability and/or rescue of occupants in the event of a ditching.

It should be noted that the operator (and the operator’s pilots) could have conducted airborne inspections, take-offs and approaches at the beach ALAs in such a way as to not be exposed to the need for ditching (and therefore the need to carry life jackets). The manner in which the flight segments were done, and the absence of life jackets, is consistent with the operator (and its pilots) not fully appreciating the risk of its operations at the beach ALAs.

Maintenance control

A comparison of the data on the aircraft’s GPS unit, the pilot of the accident flight’s logbook and the aircraft’s current maintenance release identified that the total flight time documented on the maintenance release underestimated the actual flight time during the period from 14 November 2016 to 4 January 2017. A detailed review of maintenance documentation and other information confirmed that the flight time documented on the aircraft’s maintenance releases underestimated the actual flight time by 96.2 hours (or 32 per cent) from 1 May 2015 until the accident on 10 January 2017.

The underestimation of the aircraft’s flight time was not associated with a small number of errors or one type of error. It appeared to involve a more systematic pattern of not including many flights and also underestimating (slightly) the duration of many flights. It is apparent that even though an hour meter was on board to accurately record flight time, it was not being used during this period.

The effect of the underestimation of the aircraft’s flight time was that, from 1 May 2015 until 10 January 2017, three periodic inspections should have been conducted but only two periodic inspections were conducted. In addition, at least one if not more additional oil and oil filter changes should have been conducted during this period.

It is not possible to conclude that the omission of this scheduled maintenance during this period contributed to the engine power loss. As previously stated, no defects with the actual engine were identified following the accident. In addition, a periodic inspection of the aircraft was conducted about 43.8 flight hours (and just under 4 months) prior to the accident.

Nevertheless, routine maintenance of an aircraft and its engine in accordance with regulatory requirements and manufacturer requirements is vitally important for continuing airworthiness, particularly for passenger transport operations. Given that the aircraft was being operated on beaches (and therefore exposed to salt and salt spray), was conducting short sectors and regularly conducting near-aerobatic manoeuvres, it would have been prudent to do more than the required level of maintenance rather than conduct less.

Aircraft loading

Excessive weight reduces the performance of an aircraft, with the most significant deficiencies of an overweight aircraft being a longer take-off distance required, reduced rate of climb and higher (faster) stalling speed. In addition, continued overweight operations can also accelerate the onset of structural failure induced by metal fatigue.

The operator’s process for managing aircraft weight was based on pre-calculated load and trim sheets, with default weights for fuel, pilot, passengers and baggage. The operator’s pilots relied on estimated weights of passengers and baggage, and they stated they only weighed passengers or baggage (or sought accurate weights) if they believed their estimated weights were more than the pre-calculated load and trim sheet weights.

In this case, both the chief pilot and the pilot of the accident flight believed the passengers and baggage was such that VH-WTQ was loaded well below its maximum take-off weight (MTOW). However, a detailed review of the available information found that the aircraft was at least 17 kg over its MTOW, and the pilots had underestimated the weight of the passengers and the baggage. The available evidence also indicates that the operator’s other aircraft (VH-JER), flown by the chief pilot, was loaded above its MTOW on the first flight of the day.

Guidance material from CASA released in 1990 advised against the practice of using standard weights for aircraft with less than seven seats, and it advocated for the use of accurate weights. CASA had also specifically advised the operator during a site inspection in 2015 against the practice of using standard weights, and the chief pilot had replied in writing that in future the operator’s pilots would weigh all passengers and baggage. Unfortunately, that did not occur.

There was some doubt regarding which version of the operator’s pre-calculated load and trim sheet 10 was used for the accident flight. The old version (initially provided to the ATSB) had an incorrect basic empty aircraft weight, and a later version had the correct basic empty weight but also had a default passenger weight of 65 kg. This default passenger weight was significantly below the Australian average weight for adult males (86 kg) and it was also below the average weight for adult females (71 kg).

If the load and trim sheet was being used as a guide for determining when to weigh passengers, then a default weight of 65 kg would mean that almost all the passengers the operator transported should have been weighed, particularly when three passengers were on a flight. The use of such a weight should have raised a significant concern with the operator (and its pilots) about the suitability of the pre-calculated load and trim sheet.

There was insufficient evidence to determine what, if any, effect the overweight operation of the aircraft had on the flight characteristics or the development of the accident. The excess weight would have had resulted in a minor increase in the stall speed, but even if the aircraft was below the MTOW then similar consequences would very likely have resulted. Although the aircraft was overweight, it was still loaded within balance.

Contrary to both regulatory requirements and the operator’s written procedures, the baggage and camp supplies in the aircraft were not restrained by any means. This increased the risk of load shift in-flight and loss of controlled flight, and/or injuries to the aircraft’s occupants through the movement of unrestrained objects caused by in-flight turbulence or by unusual accelerations during in-flight manoeuvres or a collision. However, in this case, as far as could be determined, the unsecured baggage and camp supplies did not contribute to any of the occupant’s injuries during the collision with terrain. Nevertheless, the operator did not have any cargo nets or similar means for securing loads in its aircraft, and this increased the risk of injury on the operator’s other flights due to unsecured loads.

Aerobatic and near-aerobatic manoeuvres

The operator’s passenger charter flights to the beach ALAs routinely involved various manoeuvres conducted to provide passengers with additional enjoyment. During the accident flight, these manoeuvres included steep turns, steep climbs and descents, quickly pitching down then up and quickly yawing from side to side. One of the turns involved a bank angle of slightly more than 60º, and therefore could be classified as an aerobatic manoeuvre as per the applicable regulations, although this bank angle was only exceeded for a brief period (less than 1 second). The extent to which the other manoeuvres could be classified as aerobatic depends largely on the interpretation of the term ‘abrupt’.

The chief pilot and the pilot of the accident flight stated that their manoeuvres were not aerobatic and were within the specified limits. There was very limited video information available from other flights in recent years to assess the extent to which their flights involved aerobatic manoeuvres.

Regardless of whether the flights involved manoeuvres that could be classified as aerobatic, they were still problematic. Firstly, the manoeuvres were not consistent with the requirements of passenger charter flights specified in the operator’s Operations Manual. The operator had developed a passenger consent form that provided details of some limits for the manoeuvres. However, its manual did not contain any details of how the manoeuvres were to be conducted, the limits for all the manoeuvres and any controls in place to ensure that these limits were not exceeded.

Secondly, the operator did not have appropriate procedures and practices in place to minimise the risk associated with conducting near-aerobatic manoeuvres. As a minimum these should have included securing all loads prior to conducting any manoeuvres. It would also have been prudent to consider removing the controls in the right front-seat position, fitting upper torso restraints (UTRs) to the rear seats, conducting the manoeuvres at a height significantly more than 1,000 ft, and checking each pilot’s performance of the manoeuvres on a regular basis through proficiency checks or flight reviews.

Ultimately, the performance of near-aerobatic (and potential aerobatic) manoeuvres on the accident flight occurred a significant time before the engine power loss. Although these manoeuvres may have unported one of the fuel tanks during the en route phase, there was insufficient evidence to conclude that they contributed to the subsequent engine power loss during the airborne ALA inspection. Nevertheless, the conduct of the manoeuvres was another aspect of the operator’s activities that was not effectively controlled by the operator.

Wyndham Aviation organisational factors

The operator’s passenger charter activities were fairly basic in nature. They involved the use of relatively simple, small aircraft on short visual flight rules (VFR) flights to the same locations, with very little aircraft traffic to consider. Nevertheless, the operations did involve some hazards that had to be effectively controlled. In addition to the normal hazards associated with flying any aircraft, these included conducting take-offs, approaches and landing on beaches and near water, as well as the use of various en route manoeuvres that were not consistent with a normal passenger charter flight.

As already indicated in this safety analysis section, a number of problems were identified with the operator’s procedures and practices. The problem most directly related to the accident was the procedures and practices for airborne inspections of the Middle Island ALA not managing the risk of an engine failure or power loss. In addition, other problems already discussed included:

• pilots relying on estimated rather than actual weights of passengers, baggage and cargo when calculating an aircraft’s weight and balance
• baggage and cargo routinely not being secured for flight
• conduct of near-aerobatic manoeuvres without any procedures specified for such manoeuvres
• the documented flight hours for VH-WTQ significantly underestimating the actual flight hours
• aircraft not being equipped with life jackets on flights were life jackets were required.

In addition, a number of other problems were identified during the investigation. These included:

• no diagrams of the ALAs included in the Operations Manual
• departures from the beach ALAs often involving turns after take-off conducted well below 500 ft above ground level (AGL) and approaches to the beach ALAs routinely being conducted with turns onto final approach below 500 ft AGL
• manoeuvring in the circuit area at the beach ALAs often below 500 ft AGL, particularly around the lighthouse at Bustard Head
• flights being conducted in an aircraft with maintenance requirements listed on the maintenance release not being certified as being completed
• the portable emergency locator beacon (ELB) on board VH-WTQ not having a current registration and not being registered to the operator.

These limitations included some routine deviations from regulatory and Operations Manual requirements (such as securing loads), routine deviations from widely-accepted practices (turns below 500 ft) and activities conducted without relevant procedures documented to reduce the risk (such as the near-aerobatic en route manoeuvres). There was also evidence of previously identified problems not being effectively addressed (such as the use of estimated rather than actual weights for passengers). Overall, the number of the problems, and the nature of some of the problems, indicated that the operator’s activities were not being effectively controlled and they were not consistent with the safe conduct of passenger charter operations.

The operator was very small in nature, with the chief pilot holding all the key positions and owning both aircraft. He also managed the commercial side of the operation, and was actively involved in managing the commercial activities at the camp sites. In addition, the chief pilot conducted most of the operator’s flights. The pilot of the accident flight was the only other employee, who conducted a small proportion of the flights, but normally at the same time as flights conducted by the chief pilot. However, even for that pilot’s flights, the chief pilot still completed most of the associated paperwork, including the maintenance release.

There could be many reasons for the number and nature of the limitations with the operator’s procedures and practices. The chief pilot was probably experiencing a significant workload with his many roles and activities, but the extent to which this was excessive or led to any of the problems was difficult to determine. There was also some evidence to indicate that the chief pilot was not familiar with all of the requirements associated with his role of head of aircraft airworthiness and maintenance control (HAAMC). However, the requirements associated with accurately recording flight hours on a maintenance release were not complex. In addition, the nature of the operator’s flights, to take customers to an adventure camp site, provided incentives to entertain the passengers during the flight.

Regardless of the reasons for the number and variety of problems, a salient aspect of the operator’s activities was that there was no regular, independent process of reviewing operations to ensure they met appropriate standards. Without regular review, there was the significant potential for operations to drift away from appropriate standards, particularly when no standards or procedures were actually prescribed in the first place.

One potential mechanism for reviewing operations would have been through the operator conducting regular proficiency checks of the pilots. However, there was no requirement for a small passenger charter operator such as Wyndham Aviation to conduct regular proficiency checks. The pilots were only required to undertake an aeroplane flight review every 2 years with an instructor to maintain the privileges of their licences, but this review covered basic flight operations and was not required to be tailored to the operator’s operations or use the operator’s aircraft.

Because the chief pilot wanted to take some leave, he organised for another pilot to act as chief pilot for a short period in late 2015. However, the extent to which this acting chief pilot was able to provide a review of practices was unclear, as he conducted little observation of the other pilots’ activities during routine operations and, because the procedures for some key tasks were not well defined, he may not have realised exactly how operations were normally conducted. Another potential review mechanism was the oversight by CASA, which is discussed in the next section.

There was no requirement for the operator to have a safety management system (SMS), nor would it be reasonable to expect that an operator this size could have all of the facilities and processes required for a mature SMS. Nevertheless, to help ensure that operations are conducted to an appropriate standard, the use of regular, independent review mechanisms of actual operations would be important for this type of operator to prevent the accumulation of multiple problems increasing the risk associated with the operation.

Regulatory oversight

As noted in ATSB’s investigation report AO-2009-072 (reopened), released in November 2017:

AOC approval and surveillance processes will always have constraints in their ability to detect problems. In particular, there is restricted time and limited resources available for these activities. Regulatory surveillance is therefore a sampling exercise, and cannot examine every aspect of an operator’s activities, nor identify all the limitations associated with these activities. Even when surveillance is conducted on some system elements, problems may subsequently develop as the nature and size of operators change over time…

Given such constraints, the limited number of oversight activities CASA undertakes need to be as effective as possible. With regard to Wyndham Aviation, CASA’s primary surveillance activities were the investigation of a complaint (about advertised aerobatic manoeuvres) in late 2009 and site inspections conducted in 2011 and 2015.

CASA was aware that the operator’s primary activity was conducting passenger charter flights to beach ALAs, and it was aware that there was some specific hazards and inherent risk involved in such activities. Although it had required the operator to include procedures for beach landings in its Operations Manual prior to issuing the operator with its initial air operator certificate (AOC) in 2009, as far as could be determined, it had not examined the operator’s procedures or practices for beach operations at any stage after it commenced operations.

The two site inspections did examine a range of elements that have relevance to many small passenger transport operators using small aircraft, such as maintenance records, pilot records and aircraft loading. However, the lack of any apparent focus on operations at the beach ALAs indicates that the surveillance was not planned with the specific activities, hazards and risk controls of the operator in mind. Unfortunately, the full nature of the considerations undertaken by CASA inspectors when scoping the surveillance events was difficult to determine given the limited documentation available about these events.

Another relatively unique aspect of the operator’s activities that could reasonably have been considered in the scope of the surveillance events was the conduct of near-aerobatic manoeuvres. The available evidence indicates that CASA personnel had awareness that such activities were being conducted, and they were discussed during the 2015 surveillance event to some extent. However, a more detailed examination would have been warranted given previous complaints, and the absence of any associated procedures in the Operations Manual.

The ATSB recently noted limitations with CASA’s surveillance processes of charter operators during the period up to 2009 in its AO-2009-072 (reopened) investigation report (released in November 2017). It concluded there was a safety issue at that time with the procedures and guidance for conducting surveillance events not formally including the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. With the introduction of the CASA Surveillance Manual in 2012, there appeared to be no additional guidance procedures or guidance that addressed this issue. A review of the available evidence associated with the surveillance of Wyndham Aviation suggests that this safety issue still existed in practice during the period up to 2017.

It is difficult to determine whether additional focus by CASA during surveillance events on operations at beach ALAs would have identified the specific problem associated with the airborne inspections and the management of the risk of engine failures during these inspections. If CASA had identified exactly where the beach landing area at Middle Island was, this should have led to questions regarding how approaches, landings and take-offs (and potentially airborne inspections) were conducted close to the water. However, given some of the evidence discussed in this investigation report, it is possible that the operator’s description of these activities may not have been accurate. It is also possible that any observed activities may not have reflected normal operations.

In summary, CASA conducted a small amount of surveillance of Wyndham Aviation after issuing its initial AOC in June 2009, consistent with its available resources and priorities. However, the effectiveness of these surveillance events could have been enhanced with a more systematic approach to considering the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that are important for managing those threats or hazards. Providing specific procedures and guidance to inspectors about this issue could improve the quality of some future surveillance events.

__________

55. The Cessna 172M Owner’s Handbook stated that it would take about 7 seconds for the flaps to fully extend during flight.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving a Cessna 172M, registered VH-WTQ, that occurred at Middle Island aeroplane landing area, Queensland on 10 January 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• While the pilot was conducting an airborne inspection of the beach aeroplane landing area (ALA) at an altitude of about 60 ft, the aircraft’s engine had a sudden and total power loss.
• Under significant time pressure, the pilot elected to conduct a significant left turn to the beach at a very low height. Although he believed it to be the safest option under the circumstances, it was inconsistent with standard training and guidance to land within 30º either side of straight ahead following an engine failure at a low height.
• During the continued left turn toward the beach, the aircraft did not have sufficient performance to avoid a collision with terrain, and it impacted terrain with little or no control and a significant descent rate.
• The operator normally conducted airborne inspections of the Middle Island aeroplane landing area at about 50–100 ft while flying at normal cruise speed towards an area of water, and its procedures did not ensure the effective management of the risk of an engine failure or power loss when at a low height. [Safety issue]
• The aircraft was not fitted with upper torso restraints for the rear passenger seats, which very likely increased the severity of the injuries sustained by the two rear-seat passengers.
• Upper torso restraints (UTRs) were not required for all passenger seats for small aeroplanes manufactured before December 1986 and helicopters manufactured before September 1992, including for passenger transport operations. Although options for retrofitting UTRs are available for many models of small aircraft, many of these aircraft manufactured before the applicable dates that are being used for passenger transport have not yet been retrofitted. [Safety issue]

Other factors that increased risk

• General industry guidance on the conduct of precautionary search and landings provides information on many important aspects, including recommended heights and configurations. However, little (if any) of the guidance specifically discusses the importance of considering the risk of an engine failure or power loss when conducting precautionary search inspections at a low height.
• There was no requirement for operators of passenger transport flights in aircraft with six or less seats to provide passengers with a verbal briefing, or written briefing material, on the brace position for an emergency landing or ditching, even for aircraft without upper torso restraints fitted to all passenger seats. [Safety issue]
• The operator routinely conducted passenger charter flights into aeroplane landing areas with airborne inspection, arrival and departure flight paths over water, such that if an engine failure occurred the pilot would have been required to ditch. However, life jackets were not carried on board the aircraft for such flights.
• The flight time documented on the aircraft’s maintenance releases often did not reflect the actual flight time, resulting in a total underestimation of the actual flight time by about 96 hours (or 32 per cent) during the period from May 2015 until January 2017. This underestimation resulted in the aircraft receiving less periodic (100 hourly) inspections and oil and oil filter changes than was required.
• The aircraft was at least 17 kg above its maximum take-off weight when it departed for the flight, and baggage and camp supplies stored in the baggage compartment were not effectively secured.
• Although the operator’s procedures required that actual weights be used for passengers, baggage and other cargo, this procedure was routinely not followed, and pilots relied on estimated weights when calculating an aircraft’s weight and balance. [Safety issue]
• Although the operator’s procedures required that baggage and cargo be secured during flight, this procedure was routinely not followed, and the aircraft were not equipped with cargo nets or other means for securing loads in the baggage compartment. [Safety issue]
• The operator’s pilots routinely conducted near-aerobatic manoeuvres during passenger charter flights. However, procedures for these manoeuvres were not specified in the operator’s Operations Manual, and there were limited controls in place to manage the risk of these manoeuvres. [Safety issue]
• There were a significant number and variety of problems associated with the operator’s activities that increased safety risk, and the operator’s chief pilot held all the key positions within the operator’s organisation and conducted most of the operator’s flights. Overall, there were no effective mechanisms in place to regularly and independently review the suitability of the operator’s activities, which enabled flight operations to deviate from relevant standards. [Safety issue]
• Although the operator’s primary activity since July 2009 was passenger charter flights to beach aeroplane landing areas (ALAs), regulatory oversight by the Civil Aviation Safety Authority had not examined the operator’s procedures and practices for conducting flight operations at these ALAs.
• The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. [Safety issue]

Other findings

• The reason for the sudden and total engine power loss could not be determined. A fault or defect with the engine and carburettor icing were both considered unlikely, and there was more than sufficient fuel on board the aircraft for the flight. However, airframe issues such as fuel supply faults could not be excluded.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Operator’s procedures and practices for airborne inspections of a landing area 

Safety issue number: AO-2017-005-SI-01

Safety issue description: The operator normally conducted airborne inspections of the Middle Island aeroplane landing area at about 50–100 ft while flying at normal cruise speed towards an area of water, and its procedures did not ensure the effective management of the risk of an engine failure or power loss when at a low height.

Operator’s aircraft loading practices

Safety issue number: AO-2017-005-SI-02

Safety issue description: Although the operator’s procedures required that actual weights be used for passengers, baggage and other cargo, this procedure was routinely not followed, and pilots relied on estimated weights when calculating an aircraft’s weight and balance.

Operator’s practices for securing baggage and other cargo

Safety issue number: AO-2017-005-SI-03

Safety issue description: Although the operator’s procedures required that baggage and cargo be secured during flight, this procedure was routinely not followed, and the aircraft were not equipped with cargo nets or other means for securing loads in the baggage compartment.

Operator’s conduct of near-aerobatic manoeuvres during charter flights

Safety issue number: AO-2017-005-SI-04

Safety issue description: The operator’s pilots routinely conducted near-aerobatic manoeuvres during passenger charter flights. However, procedures for these manoeuvres were not specified in the operator’s Operations Manual, and there were limited controls in place to manage the risk of these manoeuvres.

Operator’s processes for reviewing its operations

Safety issue number: AO-2017-005-SI-05

Safety issue description: There were a significant number and variety of problems associated with the operator’s activities that increased safety risk, and the operator’s chief pilot held all the key positions within the operator’s organisation and conducted most of the operator’s flights. Overall, there were no effective mechanisms in place to regularly and independently review the suitability of the operator’s activities, which enabled flight operations to deviate from relevant standards.

Requirements for upper torso restraints in small aircraft

Safety issue number: AO-2017-005-SI-06

Safety issue description: Upper torso restraints (UTRs) were not required for all passenger seats for small aeroplanes manufactured before December 1986 and helicopters manufactured before September 1992, including for passenger transport operations. Although options for retrofitting UTRs are available for many models of small aircraft, many of these aircraft manufactured before the applicable dates that are being used for passenger transport have not yet been retrofitted.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority consider mandating the fitment of upper torso restraints (UTRs) for all seats in small aeroplanes and helicopters, particularly for those aircraft (a) being used for air transport operations and/or (b) for those aircraft where the aircraft manufacturer has issued a mandatory service bulletin to fit UTRs for all seats (or such restraints are readily available and relatively easy to install).

Safety advisory notice description: The Australian Transport Safety Bureau strongly encourages operators and owners of small aeroplanes manufactured before December 1986 and helicopters manufactured before September 1992 to fit upper torso restraints to all seats in their aircraft (if they are not already fitted).

Requirements for briefing the brace position in small aircraft

Safety issue number: AO-2017-005-SI-07

Safety issue description: There was no requirement for operators of passenger transport flights in aircraft with six or less seats to provide passengers with a verbal briefing, or written briefing material, on the brace position for an emergency landing or ditching, even for aircraft without upper torso restraints fitted to all passenger seats.

Regulatory surveillance – scoping of surveillance events

Safety issue number: AO-2017-005-SI-08

Safety issue description: The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.

ATSB safety recommendation to the Civil Aviation Safety Authority 

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority undertake further work to improve its procedures and guidance for scoping surveillance activities to formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Civil Aviation Safety Authority

Oversight of the operator following the 10 January 2017 accident

On 11 January 2017 (the day after the accident), the Civil Aviation Safety Authority requested the operator to cease flight operations under its Air Operator’s Certificate (AOC) until CASA could be assured that operations could continue safely. On 27 January 2017, following subsequent investigation by CASA, the operator was issued with a notice of immediate suspension of its AOC. On 10 March 2017, the operator requested that CASA cancel its AOC.

Regulatory changes

In December 2018, Civil Aviation Safety Regulation (CASR) Part 135 (Australian air transport operations–Smaller aircraft) and CASR Part 119 (Australian air transport operators–certification and management) were made. These new regulations come into effect in March 2021 and include some new requirements for operators conducting passenger transport flights using small aeroplanes.

With relevance to some of the safety issues identified with Wyndham Aviation in this investigation, these requirements include more frequent proficiency checks of pilots and safety management requirements. More specifically:

• Part 135 includes a requirement for operators to conduct proficiency checks on pilots. The draft Manual of Standards (MOS) for Part 135, publicly consulted in September 2018, includes specific requirements for recurrent proficiency checks.  For VFR flights, these include a proficiency check initially between 5 and 7 months after commencing unsupervised line operations for the operator and subsequently at intervals of not more than 12 months. The proficiency checks are required to demonstrate that a pilot is competent to carry the applicable duties of the pilot in the operator’s aeroplane.
• Part 119 includes a requirement for an operator to have a safety management system. The requirements for introducing a safety management system for current charter operators will be the subject of public consultation in late 2019.
• Part 119 also includes a requirement for an operator to have a safety manager. The same person can not hold the position of safety manager and the position of chief executive officer (except in an unforeseen circumstance). The requirements for engaging a safety manager are included in the rules pertaining to the introduction how a safety management system is to be introduced. 

__________

NOTE: The full bulletin, and other CASA cabin safety bulletins, is available on the CASA website at www.casa.gov.au/aircraft/standard-page/cabin-safety-bulletin.

General details

Pilot details

Aircraft details

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of the accident flight and another pilot who conducted flights for the operator
• the operator and the chief pilot of Wyndham Aviation Pty Ltd
• the Civil Aviation Safety Authority
• the Queensland Police Service
• the aircraft manufacturer
• the maintenance organisation for VH-WTQ
• Airservices Australia
• some of the passengers on the operator’s aircraft and people at the camp site on the day of the accident
• video footage of the accident flight and other photographs and videos taken on the day of the accident
• recorded data from the Global Position System (GPS) unit on the aircraft.

References

Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.

Casner SM, Geven RW & Williams RT 2013, ‘The effectiveness of airline pilot training for abnormal events’, Human Factors: The Journal of the Human Factors and Ergonomics Society, vol. 55, pp.477-485.

Civil Aviation Authority New Zealand 2015, ‘The impossible turn’, Vector, July/August, pp.4-6.

Civil Aviation Safety Authority 2001, Proposed Airworthiness Directive, General Series – Upper torso restraints for occupants in small aircraft, Discussion Paper, Document DP 0109CS, December 2001.

Dismukes RK, Berman BA & Loukopoulos LD 2007, The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Aldershot UK.

Dismukes RK, Goldsmith TE & Kochan JA 2015, Effects of acute stress on aircrew performance: Literature review and analysis of operational aspects, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2015-218930.

Kahneman D 2011, Thinking, fast and slow, Allen Lane London.

Klein G 1998, Sources of power: How people make decisions, Massachusetts Institute of Technology.

Landman A, Groen EL, van Passen VV, Bronkhorst AW & Mulder M 2017, ‘The influence of surprise on upset recovery performance in airline pilots’, The International Journal of Aviation Psychology, vol. 27, pp.2–14.

National Transportation Safety Board 2005, General aviation crashworthiness project: Phase two – Impact severity and potential injury prevention in general aviation accidents, Safety Report NTSB/SR-85/01.

National Transportation Safety Board 2011, Airbag performance in general aviation restraint systems, Safety Study NTSB/SS-11/01.

Newman RL 1988, ‘Ditchings: A case history and a review of the record’, SAFE Journal, vol. 18, pp.6–15.

Rostykus PC, Cummings P & Mueller BA 1998, ‘Risk factors for pilot fatalities in general aviation airplane crash landings’, Journal of the American Medical Association, vol. 280, pp.997-999.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Stobie N 2019, ‘You’re one and only: Mitigating the risk of engine failures in singles’, Flight Safety Australia, uploaded March 2019. Available from www.flightsafetyaustralia.com.

Wickens CD & Hollands JG 2000, Engineering psychology and human performance, 3rd edition, Prentice-Hall International Upper Saddle River, NJ.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the operator, the pilot and the Civil Aviation Safety Authority (CASA).

Submissions were received from the operator, the pilot and CASA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Review of VH-WTQ’s total time in service

Introduction

A review of data from the Global Position System (GPS) unit on board VH-WTQ identified an apparent discrepancy between the hours documented on the aircraft’s maintenance releases and the flight hours recorded by the GPS unit on several days. A review of maintenance records and other sources of information was undertaken to confirm whether there was a discrepancy.

Comparison of GPS data with other information

The ATSB compared the data from the GPS unit recovered from VH-WTQ for the period from 14 November 2016^[57] to 4 January 2017 with other sources of evidence. Relevant information included:

• The GPS unit on board VH-WTQ was hard-wired into the aircraft, and the chief pilot stated that, as far as he was aware, the unit was never removed from the aircraft and used in other aircraft.
• The pilot of the accident flight documented daily flight times in his logbook using standard amounts of 12 minutes (0.2 hours) corresponding to each standard flight from Agnes Water aeroplane landing area (ALA) to one of the beach ALAs or return (that is, 0.4 hours for a return trip).^[58]
• Based on this pattern, there was a perfect correspondence between the pilot’s logbook for flights in VH-WTQ and the GPS data for the number of standard flights between Agnes Water and a beach ALA. The number of standard flights was the same for each of the 27 days that flights were documented in the pilot’s logbook and recorded on the GPS unit (a total of 122 flights).^[59]
• There were 2 other days (a total of four standard flights) where flights were recorded on the GPS unit but no flights were documented in the pilot’s logbook. During this period, the only other pilot conducting flights for the operator was the chief pilot. The chief pilot could not recall conducting any flights in VH-WTQ after the aircraft’s last periodic inspection on 20 September 2016.
• The flight time of each flight recorded on the GPS unit was estimated.^[60] Overall, the total flight time for the period from 14 November 2016 to 4 January 2017 (the last flights recorded on the GPS unit prior to the accident flight) was 19.3 hours. The total flight time documented on the current maintenance release during this period was 13.95 hours. This difference indicated that the maintenance release flight time underestimated the GPS-based flight time by 5.3 hours (or about 28 per cent) during this period.

In terms of the manner in which the underestimation of the flight time occurred:

• For almost all the days with documented flights from November 2016 to January 2017, the daily flight time figure on the maintenance releases was in units of 0.25 hours (or 15 minutes).^[61] This appeared to indicate that each trip from Agnes Water to one of the beach ALAs and return was estimated to take 15 minutes. A review of the flight times from the GPS data indicated that such trips averaged 17.5 minutes (0.3 hours).
• On many of the trips from Agnes Water to a beach ALA, there was one or more additional short flights from one beach ALA to the other beach ALA. These trips averaged 2.7 minutes (0.05 hours) and did not appear to be included in the figures on the maintenance release (or the pilot’s logbook).
• Daily flight times for 3 days on which flights were recorded on the GPS unit and documented in the pilot’s logbook were not included on the maintenance release.
• Daily flight times for 2 days on which flights were recorded on the GPS unit but not documented in the pilot’s logbook were not included on the maintenance release.^[62]
• For several days, the number of standard flights between Agnes Water and a beach ALA recorded on the GPS unit and indicated in the pilot’s logbook was more than that indicated in the daily flight times on the maintenance release.

In summary, a comparison of the flight time recorded on the GPS unit with the flight time documented on the current maintenance release for the period 14 November 2016 to 4 January 2016 indicated that the maintenance release flight time underestimated the actual (GPS-based) flight time by 5.3 hours (or 28 per cent) during this period. The underestimation was associated with a number of discrepancies, including the flight time associated with many flights between Agnes Water and a beach ALA being slightly underestimated, short flights between the beach ALAs not being included, and some flights between Agnes Water and a beach ALA not being included.

Review of maintenance records

In order to confirm whether the discrepancy in estimated flight hours between the GPS data and the maintenance release could be confirmed during the same period and or other periods, the ATSB conducted a review of the aircraft’s maintenance documentation. Relevant information included:

• The aircraft was fitted with an Omron H7ET hour meter, which provided a digital display of cumulative time based on output signals received from a sensor (Figure A1).^[63] A label next to the meter stated that it displayed ‘FLIGHT SWITCH HOURS’.
• It is common and accepted practice to use estimated flight time (or hours flown) rather than engine time for determining the maintenance requirements of small aircraft.^[64] The aircraft had an airswitch sensor located under the right wing. The exact mechanism for triggering the recording of hours on the meter was not determined, but it was probably based on the airswitch sensing an air pressure corresponding to an airspeed value (which approximated when the aircraft was airborne).
• The aircraft’s maintenance records indicated that the hour meter was last reset to a value of 0 hours in February 1998, when the aircraft total time in service (TTIS) was 3,862.0 hours. Therefore, the hour meter readings should have been about 3,862 hours less than the TTIS.
• After Wyndham Aviation acquired the aircraft in November 2013, the progressive total documented on the aircraft’s maintenance releases^[65] after a day’s flights was the current figure displayed on the hour meter. The aircraft’s TTIS was calculated at each periodic (100 hours) inspection by maintenance personnel subtracting the current hour meter reading from the documented hour meter reading at the time of the previous periodic inspection, and adding this figure to the TTIS documented at the previous periodic inspection.
• In a site inspection conducted in March 2015, the Civil Aviation Safety Authority (CASA) identified that the operator was documenting the current hour meter reading in the progressive total column for VH-WTQ after each day’s flights whereas the TTIS should have been documented in that column. It issued the operator with a non-compliance notice (NCN) to address the deficiency.
• On 1 June 2015, the operator started documenting the TTIS in the progressive total column on the maintenance releases after each day’s flights. As of 29 May 2015, the TTIS was 6,631.1 hours and the hour meter reading was 2,773.4 hours. No further hour meter readings were documented on the aircraft’s maintenance releases. The difference between the TTIS and the hour meter reading (3,857.7 hours) at that time was very close to the TTIS when the hour meter was last reset 17 years before (3,862.0 hours), indicating that the hour meter was regularly being used to record the aircraft’s flight time.
• During the period from January 2014 to May 2015, the pilot of the accident flight conducted many flights in VH-WTQ. In the vast majority of cases, the flight times documented on the maintenance releases were less than the flight times documented in the pilot’s logbook.^[66] This is consistent with the hour meter recording the estimated flight time whereas the pilot’s logbook figures included flight time and taxi time.
• The next periodic inspection was conducted on 12 November 2015. At that time the TTIS documented on the maintenance release was 6,704.9 hours, which indicated there had been 93.7 hours flown since the last periodic inspection on 1 May 2015 (see Table A1).
• On maintenance worksheets for the 12 November 2015 periodic inspection, an hour meter reading of 2,909.1 hours was documented, which indicated there had been 155.9 hours since the 1 May 2015 periodic inspection. These figures indicated that the flight time documented on the maintenance releases underestimated the actual flight time by 62.2 hours (or 40 per cent) during the period from 1 May 2015 to 12 November 2015. The underestimating only appeared to start from 1 June 2015, after the practice of documenting the current hour meter readings on the maintenance releases was discontinued.
• The last periodic inspection prior to the accident was conducted on 20 September 2016. No hour meter reading was documented in the maintenance documentation. The TTIS was documented as 6,804.7 hours, which indicated there had been 99.8 hours since the 12 November 2015 periodic inspection.
• The current maintenance release at the time of the accident (issued 20 September 2016) had a TTIS prior to the accident flight of 6,838.4 hours, which indicated there had been 33.7 hours since the 20 September 2016 periodic inspection and 133.5 hours since the 12 November 2015 periodic inspection.
• The hour meter reading after the accident was 3,077.0 hours (Figure A1), and this figure was also visible in the video footage of the accident flight at 1037:39 (20 seconds prior to impact). The reading prior to take-off would therefore have been about 3,076.9 hours. This figure indicated there had been 167.8 hours flight time since the 12 November 2015 inspection. It also indicated that the flight time documented on the maintenance releases underestimated the actual flight time by 34.3 hours (or 20 per cent) during the period from 12 November 2015 to 10 January 2017.
• There was no evidence in the maintenance records that the hour meter was considered faulty during the period that Wyndham Aviation used the aircraft from 2013 to 2017. The chief pilot and pilot of the accident flight reported that they were not aware of any problems with the aircraft’s hour meter.

Figure A1: Hour meter on VH-WTQ displaying the value at the time of impact

Source: ATSB.

Table A1: Recorded TTIS and hour meter readings during the period VH-WTQ was used by Wyndham Aviation

In summary, a comparison of the flight time obtained from hour meter readings and the flight time documented on the aircraft’s maintenance releases indicated that the maintenance release figures underestimated the flight time by 96.5 hours (or about 32 per cent) during the period from 1 May 2015 to 10 January 2017. During this period, 207.3 flight hours were documented whereas the ATSB estimated that 303.8 flight hours were conducted.

This information was consistent with that provided by the comparison of the documented flight times on the aircraft’s maintenance release with the data recorded on the GPS unit for the period from 14 November 2016 to 4 January 2017 (an underestimation of about 28 per cent).

Other observations

Given a total underestimation of 96.5 hours since 1 May 2015, the aircraft’s TTIS prior to the 10 January 2017 accident flight should have been 6,934.9 hours rather than 6,838.4 hours.

As previously stated, the hour meter reading was not documented during the last periodic inspection conducted on 20 September 2016. The current maintenance release indicated that 33.7 hours flight time was conducted between the inspection and the accident flight.

To estimate the actual flight time since the last maintenance, the ATSB used the GPS data for the period from 14 November 2016 to 4 January 2017 (19.3 hours). For the period from 20 September 2016 to 12 November 2016, the ATSB used the average underestimation based on hour meter data information for the period from 12 November 2015 to the accident flight (20 per cent), after accounting for the period from 14 November 2016 to 4 January 2017.^[67] Overall, the estimated flight hours since the last periodic inspection on 20 September 2016 was 43.8 hours.

Appendix B – Verification of the recorded GPS data from the accident flight

Introduction

As outlined in GPS information, the expected level of accuracy of the recorded global positioning system (GPS) data from the Garmin 296 Portable Aviation Receiver fitted to the aircraft when in steady flight was 5 m for position or horizontal accuracy and 7.5 m (or 25 ft) for altitude or vertical accuracy.

Video footage showed that, during the aircraft’s descent and the airborne inspection of the landing area up until the engine power loss, the aircraft was in steady flight. Therefore, the recorded GPS data accuracy during this period should be similar to the expected level of accuracy stated by the manufacturer. After the engine power loss, when the aircraft was turning, climbing and descending, the expected level of accuracy would have been less than in steady flight.

To verify whether the recorded GPS data was within the expected level of accuracy, the ATSB conducted a detailed comparison of the recorded GPS data with other sources.

Verification of the recorded GPS position data

Details of the recorded GPS position data were provided in Figure 1.

The pilot of the accident flight reported that the engine power loss occurred at about the position annotated with the time 1037:38 in Figure 2 rather than the position annotated by the time 1037:34. That is, he believed the power loss occurred about 240 m further north than indicated by alignment of the recorded GPS data with the video footage.

The ATSB compared the recorded GPS position data with radar data obtained from Airservices Australia. The GPS and radar data were independent. The GPS was a standalone unit that determined position and altitude internally using broadcasted satellite signals, whereas the radar data was based on signals sent from the aircraft’s transponder. A composite position derived from multiple secondary surveillance radar returns^[68] from VH-WTQ’s transponder was recorded every 5 seconds when the aircraft was above the limits of radar coverage in the area.

The recorded GPS position data and the recorded radar position data were consistent, with reduced accuracy during periods of manoeuvring (consistent with the known limitations of both types of data). The two sources of data agreed within about 50 m for the 1-minute period leading up to the engine power loss. The nearest data points to the engine power loss agreed within 33 m.^[69]

The ATSB also compared the recorded GPS position data with the location of terrain features in the video footage. Key results included:

• During the take-off roll, the recorded GPS data showed the aircraft moving down the centre of the runway at Agnes Water aeroplane landing area (ALA), consistent with the video footage. The ATSB considered that it would be reasonable to expect that if the recorded positions were accurate at the beginning of the flight they would remain accurate when the aircraft was in steady flight.
• At 1037:26, alignment of geographical features in the video footage indicated that the aircraft was close to the recorded GPS point at that time.
• At 1037:36, 2 seconds after the engine power loss, the video footage showed that the aircraft was still a significant distance south of the bend in the beach on Middle Island (see Figure B1 and the location of the bend in Figure 2). Given the aircraft’s groundspeed was about 124 kt (or 64 m/s) at that time, the image shown in Figure B1 was taken about 130 m north of the engine power loss. If the engine power loss had occurred at the position reported by the pilot, then the area of beach north of the bend should have been visible in Figure B1. Instead, this image is consistent with what would be expected if the engine power loss occurred at the position indicated in Figure 2 (based on the recorded GPS data).

Figure B1: A still image taken from the video footage 2 seconds after engine power loss (1037:36)

At the time this image was taken the phone camera was oriented to the left of the aircraft’s heading. The image shows an area of sand on Middle Island beach, just prior to a bend to the left with further beach beyond.

Source: Queensland Police Service.

The position of the aircraft indicated by the video footage also appeared to be consistent with the recorded GPS and radar position data at other times during the flight.

In summary, the recorded position data from the GPS unit was confirmed to be within the expected accuracy level based on comparing the data with available information from other sources, including radar data and the video footage.

Verification of the recorded GPS groundspeed data

The GPS calculated and recorded groundspeed data at each data point by dividing the distance between that data point and the previous data point and dividing by the time between the data points. The average recorded groundspeed in the 1-minute period up to 1037:32, 2 seconds prior to the power loss, was 125 kt. The average groundspeed in the 12 seconds up to 1037:32 was 124 kt (or about 230 km/hour).

The pilot of the accident flight reported that he did not think the aircraft was flying with a groundspeed as high as 124 kt during the airborne inspection.

The radar data provided similar groundspeeds to the GPS data in the period leading up to the engine power loss.

In addition, the ATSB considered the following information:

• The audio analysis of the video footage found that the engine/propeller speed at this time was about 2,680 RPM.
• The Cessna 172M Owner’s Manual stated that at 2,500 ft altitude, 2,700 RPM and a weight of 2,300 lb the aircraft would cruise at 134 miles per hour (116 kt).
• The reported wind at the time was 10–15 kt from the south-east, which would have provided a tailwind of about 7-11 kt.
• In the 6 seconds up to 1037:32, the aircraft was descending. Without a change in power settings or configuration, a descent will normally result in an increase in the aircraft’s groundspeed.

In summary, the recorded groundspeed data from the GPS unit was confirmed to be within the expected accuracy level based on comparing the data with available information from other sources.

Verification of the recorded GPS altitude data

Details of the recorded GPS altitude data during the later part of the flight were provided in Figure 2. More specifically, the recorded GPS altitudes above mean seal level (AMSL) at key times were:

• 45 m (148 ft) at 1037:20 (14 seconds prior to the engine power loss)
• 36 m (118 ft) at 1037:26 (8 seconds prior to the engine power loss)
• 21 m (69 ft) at 1037:32 (2 seconds prior to the engine power loss)
• 19 m (62 ft) at 1037:38 (4 seconds after the engine power loss)
• 42 m (138 ft) at 1037:46 (12 seconds after the engine power loss)
• 25 m (82 ft) at 1037:56 (22 seconds after the engine power loss and 3 seconds prior to impact).

The pilot reported that the aircraft was at about 150–200 ft when he conducted the airborne inspection and when the engine power loss occurred.

The ATSB compared the GPS data with the available information from radar data, video footage of terrain features, video footage of the altimeter and other sources to determine the best estimate of the altitude of the aircraft at the time of the engine power loss (1037:34).

The recorded radar data included transponder altitude. This is an air pressure measurement from the aircraft, measured by an encoder using the same static pressure lines as the aircraft’s altimeter but with an independent sensor, then transmitted by the aircraft’s transponder. The transponder altitude data was only recorded in 100-ft intervals. Within this limitation, the QNH-corrected^[70] transponder altitude was consistent with the GPS altitude during the flight, with the exception of some data points when the aircraft was manoeuvring (Figure B2). In particular, during the aircraft’s descent prior to the engine power loss, the recorded GPS data and radar data were in close agreement.

Figure B2: Comparison of recorded GPS and transponder altitudes

Source: ATSB.

With regard to the video footage of terrain features:

• Photogrammetry analysis^[71] of the terrain features in the video at about 1037:26 indicated that the altitude was close to that indicated by the GPS data (that is, about 120 ft). More specifically:
• The video footage showed a ridge along Middle Island with a distinctive area of sand on top (Figure B3). The top of this ridge was estimated to be at an altitude of about 100–120 ft,^[72] and the distance from the aircraft to the ridge was about 1,250 m.
• In the video, the top of this ridge had a slightly higher apparent height than a saddle 2,300 m behind the ridge (on the other side of the Jenny Lind Creek inlet) that was about 120–140 ft high. This indicated that the aircraft was at or slightly below the ridge height.
• No terrain or horizon was visible behind the high point of the ridge on Middle Island. If the aircraft was significantly higher than the ridge (120 ft), then it would have been possible to see the terrain and/or horizon behind the ridge.
• The aircraft’s vertical speed indicator (VSI) indicated a descent rate of about 350 ft/min at 1037:26, which was broadly consistent with the descent rate at the time derived from the GPS data (about 400 ft/min). Analysis of the video footage showed that the aircraft continued to descend steadily until 1037:28, then with the descent rate decreasing until it appeared to level at 1037:36. Given the recorded GPS altitude at 1037:32 was about 70 ft, and the aircraft continued to descend during the 2 seconds after this time, the estimated GPS-based altitude at the time of the engine power loss (1037:34) was about 60 ft.
• At 1037:36, 2 seconds after the engine power loss, the video footage showed some trees on Middle Island (Figure B2) at about the location of the bend in Figure 2. The apparent height of the top of these trees was notably higher than the saddle on the other side of the Jenny Lind Creek inlet. Although the exact altitude of the top of these particular trees on Middle Island is not known, they were visible in multiple photos and videos taken after the accident. Using a variety of methods, the height of these trees was estimated to be between 40–80 ft, and more likely to be in the middle of this range. Therefore, the aircraft at this time was almost certainly below 80 ft and probably below 60 ft. Based on the video footage, the aircraft appeared to be in approximately level flight around this time.
• Photogrammetry analysis of other terrain features in the video footage between 1037:29 and 1037:44 produced altitudes within about 20 ft of the recorded GPS data during this period. This method used the geometric relationship between the top and base of Bustard Head and the apparent height of the horizon behind it (Figure B4).

Figure B3: Still image from mobile phone video at 1037:26 (altimeter enhanced)

The image shows nearby terrain features: a ridge 100–120 ft high on nearby Middle Island, and a distant saddle 120–140 ft high. An enhanced section of the image shows the altimeter indication at that point, which is about 200 ft and the vertical speed indicator (VSI) showing a 350 ft/min descent. Source: Queensland Police Service.

Figure B4: Video stills at 5-second intervals during descent (last image is 3 seconds prior to engine failure)

Source: ATSB.

With regard to the altimeter indications in the video footage, the last view of the altimeter prior to the engine power loss occurred at 1037:26, when the altimeter indicated about 200 ft (Figure B3). This was significantly higher than the recorded GPS data at the same time (120 ft), and also higher than the transponder altitude and the altitude indicated by an analysis of terrain features in the video footage at the same time.

Figure B5 summarises the available information about the aircraft’s altitude during the last part of the flight. As indicated in the figure, altitude information from the recorded GPS data, radar data, and the analysis of terrain features and the horizon geometry in the video footage was in alignment during the aircraft’s descent up until the engine power loss (at 1037:34).

Figure B5: Summary of information about the aircraft’s altitude from 1037:20 until impact

Source: ATSB.

The GPS altitude and the altimeter both appeared to be higher than the aircraft’s actual altitude in the last 10 seconds of flight (after the engine power loss). This is consistent with the GPS’s reduced accuracy in manoeuvring flight, and possibly with the altimeter being affected by sideslip during that period.

With regard to the accuracy of the altimeter reading of 200 ft at 1037:26 (which was significantly higher than the GPS data and other sources):

• Transponder altitude, which was derived from barometric pressure using a different sensor to the altimeter, was within the range 50–150 ft immediately before (1027:23) and after (1027:28) the 200 ft altimeter indication. Given the aircraft was descending during this period, the radar data was therefore indicating that the altitude was significantly below 150 ft at 1027:26.
• There was inconsistency between altimeter indications. More specifically:
• As indicated above, during the period from 1037:26 until the engine power loss, the video footage showed that the aircraft was descending. Based on recorded GPS data, the ATSB estimated that the aircraft descended about 60 ft during this period. Therefore, if the indicated altitude was 200 ft at 1037:26, it should have been about 140 ft at 1037:34.
• Soon after the engine power loss, at about 1037:36, the pilot raised the aircraft’s nose and the aircraft started climbing. The indicated altitude on the altimeter at 1037:48 was about 120 ft (with the VSI indicating a rate of climb over 500 ft/min), and the indicated altitude at 1037:52 was about 140 ft (with the VSI indicating about 0 ft/min). This information suggests that the aircraft was climbing from about 140 ft for up to 15 seconds.
• If the aircraft was at 200 ft at 1037:26, then the ATSB would expect the indicated altitude on the altimeter to be significantly more than 140 ft at 1037:52 (at the top of the climb following the engine power loss). Therefore, the altimeter indication at 1037:26 was not consistent with the subsequent indications at 1037:48 and 1037:52.
• The altimeter indicated an altitude of about 70 ft just before wingtip impact, when the aircraft’s fuselage was probably 15–20 ft above ground level (which was close to sea level). Given the aircraft may not have been in coordinated flight at that time, the altimeter indication was considered less reliable than the previous indications.

In summary, given the inconsistencies between the altimeter indications and discrepancies between the altimeter indications and other sources of altitude information, none of the altimeter indications could be assumed to provide a high level of accuracy.

In addition to the comparison of the recorded GPS data with radar data and the video footage, the ATSB also considered the following information:

• The pilot of the accident flight reported that he normally conducted airborne inspections of Middle Island ALA at 150–200 ft. A review of the GPS data identified 19 previous inspections of Middle Island ALA, all of which were conducted by the pilot of the accident flight. The lowest altitudes recorded during these inspections were generally below 100 ft with a median value of about 60 ft (see Review of airborne inspections at Middle Island ALA ). Given the relatively constant descents and straight flight paths involved in these inspections, the GPS data was probably within the GPS manufacturer’s expected level of accuracy.
• On the video recording, at about 1036:37, at the start of the descent to the landing area, the pilot made a statement to the passengers that sounded like ‘going to go down to [indistinct] feet’. The rate of speech was consistent with the indistinct part having one or two syllables with an ‘i' sound (as in ‘bit’) in the first syllable. The pilot subsequently advised that he would have said ‘going to go down to one hundred and fifty feet’. Although it was not possible to ascertain exactly what he said, the short duration of the utterance and its sound was consistent with the word ‘fifty’, and it is unlikely that the utterance included any additional words, such as ‘one hundred’, prior to the word ‘fifty’.
• During the initial climb out from Agnes Water, one of the rear-seat passengers took some photos of the cockpit with an iPhone 6 mobile phone, in which the altimeter can be seen. Like the phone used to take the in-flight video, the iPhone 6 is automatically set to network (local) time by default, but it is possible to override this setting. Although it was not possible to confirm that this phone’s time was set correctly, the altimeter indications in the photos (340–360 ft) were consistent with the recorded GPS data at the same time (about 375 ft).

In summary, the comparison between the altimeter indications and the recorded GPS data provided differing values at various times towards the end of the flight. However, in the period prior to the engine power loss, the ATSB concluded that the recorded GPS data was more accurate than the altimeter indication, as it matched the analysis of radar data and terrain features in the video footage. Overall, the ATSB concluded that the altitude at the time of the engine power loss was probably between 40 and 80 ft and therefore probably close to the GPS-based altitude of 60 ft. This altitude was consistent with the recorded GPS data from previous airborne inspections flown by the pilot of the accident flight.

Information about altimeter accuracy

As noted above, the altimeter was indicating about 200 ft at 1037:26 when the aircraft was probably close to 120 ft, and it was indicating 70 ft just before impact. In addition, the indication at 1037:52 was not consistent with the previous indication and the aircraft’s subsequent descent and climb. The reasons for these discrepancies could not be ascertained. The ATSB considered the following information:

• During the post-accident inspection, the QNH set on the altimeter subscale was observed to be between 1,013 and 1,014 hPa. This was close to the actual atmospheric pressure recorded by the Bureau of Meteorology for airports in the area at the time. The QNH setting knob had broken off during the impact. It is possible that the setting had moved during impact, but it was considered unlikely that this would have resulted in a significant change in the setting.
• The aircraft’s maintenance schedule required that the altimeter be checked every 2 years, and such a check involved ensuring the accuracy of the altimeter at difference simulated air pressures. At a simulated altitude of 0 ft (or 1,013 hPa), the altimeter was required to indicate within 20 ft of that altitude (see CAO 100.5, Attachment 1 to Appendix 1). The altimeter on VH‑WTQ was last checked during a periodic inspection in May 2015, 20 months prior to the accident.
• For a visual flight rules (VFR) flight, with an accurate QNH set, an aircraft’s altimeter is only required to be accurate within 100 ft to be considered acceptable by a pilot (see the Aeronautical Information Publication ENR 1.7 section 1.3).
• The overall comparison of the altimeter indications and the GPS data suggests the altimeter values had a short period of lag or delay behind the GPS values. Although there can be a lag in altimeter indications, such a lag generally is generally considered to be very small in normal flight manoeuvres.
• Sideslip (sideways movement), such as in an uncoordinated turn, can affect altitude measurements. However, this was unlikely to be the case during the steady descent.

In summary, it is possible that there was a slight difference between the actual QNH and that set by the pilot,^[73] and the accuracy of the altimeter may have drifted slightly out of tolerance since it was last checked. Although the reasons for the altimeter over reading at 1037:26 could not be determined, it still appeared to be indicating within the required limits for a VFR flight.

Appendix C – A review of research on upper torso restraints in small aircraft

Overview

There have been many research studies into the utility of upper torso restraints on small aircraft. Based on these studies, many recommendations have been issued by government investigation agencies around the world. This appendix discusses many of these studies and recommendations.

In this report, the term ‘upper torso restraint’ (UTR) is used to refer to a shoulder harness or shoulder strap.

Research and recommendations in the United States up to 1980

In the United States, the Civil Aeronautics Board (CAB), responsible for investigating civil aircraft accidents prior to the formation of the National Transportation Safety Board (NTSB), noted there were 826 fatalities in general aviation accidents between January and October 1964. It estimated that about 200 of these fatalities could have been prevented if UTRs had been installed and used. Accordingly, it issued a recommendation to the Unites States’ Federal Aviation Authority (FAA) in 1964:

Shoulder harnesses for each occupant be required on all newly certified general aviation aircraft unless it can be demonstrated that the seatbelt alone will preclude the seat occupant from contacting injurious occupants within striking distance of the head.

The FAA replied at that time that it did not believe there was sufficient justification to revise existing regulations.

The NTSB subsequently issued a recommendation in 1970 (A-70-042), which stated in part:

Shoulder harnesses should be required on all general aviation aircraft at the earliest practical date…

The FAA subsequently issued a Notice of Proposed Rulemaking (NPRM) 73-1 regarding crashworthiness on small aeroplanes. As a result of the NPRM process, the FAA required the installation of UTRs in the front seats of small aeroplanes manufactured after 18 July 1978.

Dissatisfied with the FAA’s response to previous recommendations, the NTSB issued additional recommendations in 1977:

A-77-070: Amend 14 CFR 23.785 to require installation of approved shoulder harnesses at all seat locations as outlined in NPRM 73-1.

A-77-071: Amend 14 CFR 91.33 and .39 to require installation of approved shoulder harnesses on all general aviation aircraft manufactured before July 18, 1978, after a reasonable lead time, and at all seat locations as outlined in NPRM 73-1.

In 1980, the NTSB released a safety report that provided a summary of activities relating to improving the crashworthiness of general aviation aircraft.^[74] The report noted that FAA research and other studies since 1944 have shown that UTRs are an essential element to provide effective occupant restraint, even for minor crash forces. The report reviewed many of the research studies, recommendations and responses by the FAA in relation to UTRs. Its conclusions included:

General aviation aircraft are unnecessarily lethal in crash situations which should be survivable.

The majority of serious injuries and deaths in general aviation aircraft crashes result from insufficient occupant restraint systems and inadequate crashworthiness designs of cockpit and cabin interiors.

The installation and compulsory use of shoulder harnesses at each general aviation aircraft occupant seat would be one of the most effective means for markedly reducing the current serious injury and fatality rates.

FAA and industry studies indicate that most effective crashworthiness occupant protection features can be incorporated during aircraft design with little or no increase in manufacturing costs…

Generally, aircraft manufacturers are not voluntarily incorporating proven, effective, and necessary crashworthiness designs into their products…

Private automobile crashworthiness features have improved in comparison with general aviation aircraft, primarily because of government regulatory action…

As a result of the study, the NTSB issued additional recommendations to the FAA:

A-80-125: Require that those general aviation aircraft manufactured to include attachment points for shoulder harnesses at occupant seats be fitted with shoulder harness no later than December 31, 1985 and, in the interim, require this modification as a requisite for change in FAA registration.

A-80-126: Develop in coordination with airframe manufacturers, detailed, approved installation instructions for installing shoulder harnesses at each seat location in current models and types of general aircraft in which shoulder harness attachment points were not provided as standard equipment. Publish and provide there instructions to owners of these aircraft by December 31, 1982.

A-80-127: Require that those general aviation aircraft for which FAA-approved harness installation instructions have been developed be fitted with shoulder harnesses at each seat location no later than December 31, 1985, and, in the interim require this modification as a requisite for change in the FAA registration.

Most of the 1977 and 1980 recommendations were closed in 1986, following regulatory changes by the FAA to require that all small aeroplanes manufactured after 12 December 1986 were fitted with a UTR at each seat. The response by the FAA to recommendation A-77-071 was classified by the NTSB as ‘unacceptable action’.

Research and recommendations in the United States since 1981

In 1982, the FAA released a report^[75] examining crashworthiness aspects associated with 47 survivable or partly survivable accidents involving small aeroplanes during 1973–1979. The 47 accidents involved 138 occupants (including two lap-held children), with 47 pilots, 40 occupants of the copilot (front right) seat and 49 additional occupants. Results included:

• The greatest damage to the occupiable area of the aircraft was to the forward portion of the cockpit/cabin.
• Of the 57 occupants who had a UTR available, only 7 used the UTR, and the use of the restraint appeared to have lessened injuries.
• Of the 136 occupants, 121 or 88 per cent would have benefited from using a UTR. This included 91 per cent of the 87 front-seat occupants and 86 per cent of the 49 occupants in other seats.

In noting the benefits of a UTR, the report stated:

The value of restraining the upper torso cannot be overemphasized. For example, a seated passenger is restrained by a lapbelt and his/her upper torso may weigh as much as 120 lb [54 kg]. In an accident, the lapbelt holds the pelvis and acts as a fulcrum about which the upper torso rotates under the force of deceleration. If the deceleration is low, 2 G's, the upper torso will have an apparent weight of 240 lb 109 kg], so that the occupant can barely resist the forward thrust. At 10 G's, well within the survivability envelope, the apparent weight of the upper torso will be 1,200 lb [544 kg] and it will swing forward with great velocity, possibly hitting the head on the instrument panel and the chest against the control wheel. Based on the velocity of the upper torso and head and the stopping distance, a force of several hundred G's may be exerted on the skull or chest.

In 1985 the NTSB published a safety study examining crashworthiness in general aviation aircraft.^[76] The study examined 535 accidents involving small aircraft in 1982. The selected accidents included those where at least one occupant was fatally or seriously injured. The accidents were evaluated to determine the extent to which they were survivable, based on whether one occupant either survived or could have survived if shoulder harnesses or energy-absorbing seats were used. The data suggested that a survivable envelope was defined by impact speeds of 45 kt at 90º angle of impact, 60 kt at 45º angle of impact and 75 kt at 0º angle of impact.

The NTSB study estimated that 20 per cent of the 800 fatally-injured occupants would have had only serious injuries or minor injuries if they had been wearing a UTR. In addition, 88 per cent of 229 seriously-injured occupants would probably have had less severe head or upper body injuries, only minor injuries or no injuries if they had been wearing a UTR.

In addition, the study noted that there were five survivable accidents in which UTRs were worn by only one of two front-seat occupants. A comparison was made of the relative injuries of each occupant. It was found in each case that injury severity was less for the occupant who wore the UTR. The occupants who wore UTRs had markedly fewer head injuries.

Following the study, the NTSB issued a series of recommendations, including:

A-85-123: Amend 14 CFR Part 91 and Part 135 to require that all occupants of small airplanes use shoulder harnesses for takeoff and landing when they are available in the airplane.

A-85-124: Issue an Advisory Circular to provide pilots, passengers, and maintenance personnel with information regarding the crash survivability aspects of small airplanes. The Advisory Circular should contain, as a minimum, discussion of the benefits of using lap belts and shoulder harnesses during all phases of flight, discussion of the hazards of modifying seats, appendages to seats, and stowage of articles in space designed or available for energy management, and discussion of the need for regular inspection and maintenance of seats.

Recommendation A-85-124 was closed in 1986 (acceptable action), after the FAA prepared an advisory circular. The FAA issued Advisory Circular (AC) 21-34 (Shoulder harness – Safety belt installations) in 1993. The AC outlined the justification for installing a UTR, and provided guidance on factors to consider when installing a UTR.

In 1985, the NTSB also issued a related recommendation regarding UTRs in helicopters:

A-85-070: Amend 14 CFR Parts 27 and 29 to require that all helicopters manufactured after 12/31/1987 have shoulder harnesses installed at all seat locations.

This recommendation was closed (acceptable action) in 1993, following regulatory changes by the FAA to require that all helicopters manufactured after 16 September 1992 were fitted with a UTR at each seat.

The FAA published a study in 1989 that examined the role of seats in injury causation.^[77] The study reviewed 55 accidents involving small aeroplanes during 1981–1986, with the sample accidents involving sufficient energy to test seat performance and cause injury. The study concluded that seat damage by itself did little to define the seat’s role in injury causation. The study concluded that head trauma represented a major manifestation of life-threatening injuries. It also noted that the presence and use of UTRs ‘can improve the injury experience by reducing the likelihood of head trauma’.

A more recent study by the FAA examined fatal and serious injury accidents in Alaska during 2004-2009.^[78] There were 97 accidents involving small aeroplanes and helicopters, resulting in 113 fatalities and 75 serious injuries. The study examined many factors contributing to the accidents as well as post-crash survivability. The study concluded that up to 28 lives could have been saved with the use of UTRs, primarily in passenger seats. The study team developed a large number of suggested interventions, with the second priority intervention being to encourage UTR installation in all seats (with an emphasis on passenger seats).

Another study examined take-off and landing accidents in small aeroplanes involving an engine power loss during 1983–1992.^[79] It found that pilots wearing only a lap belt had a relative risk factor of a fatality of 1.7 compared with pilots wearing a seat belt and a UTR. That is, pilots wearing a lap belt only had a 70 per cent more chance of a fatal injury than if they were wearing a lap belt and UTR.

In 2011, the NTSB issued a report on a safety study about airbag performance in general aviation restraint systems.^[80] This report included an analysis of the effectiveness of UTRs in single-engine, non-amateur built aeroplanes. It compared the rate of fatal or serious injuries for pilots wearing lap belts only versus lap belts and UTRs for accidents during the period 1983–2008 (with the resulting sample size of 8,572 pilots). Pilots wearing only a lap belt had a risk ratio of 1.49 compared with pilots wearing a lap belt and shoulder harness (that is, a 49 per cent greater likelihood of a serious or fatal injury). The risk ratio was higher for take-off/landing accidents (1.95) than other types of accidents (1.24), and also higher for accidents that did not involve a loss of control (1.54) versus loss of control accidents (1.28).

Based on this analysis, the NTSB concluded that lap belt/UTR combinations provided significant protection beyond a lap belt alone, and fatalities and injuries would be reduced if lap belt/UTR combinations were used in all general aviation (GA) airplanes. The NTSB also issued another recommendation:

Require the retrofitting of shoulder harnesses on all general aviation airplanes that are not currently equipped with such restraints in accordance with Advisory Circular (AC) 21-34, issued June 4, 1993. (A-11-4)

In its responses, the FAA noted that thousands of aeroplanes manufactured before December 1986 did not have the structural provisions necessary for the installation of shoulder harnesses. It noted that it was working on an alternative solution involving a two-point inflatable lap belt. The NTSB responded that this would be an acceptable response to the recommendation, if the FAA required owners of all aircraft to either retrofit a UTR or a two-point inflatable lap belt for all seats. The FAA replied that the ‘economic burden levied on the GA fleet with such a mandate would outweigh any potential benefit’, and it was working on a framework to permit aeroplane owners to voluntarily replace lap belts with two-point inflatable restraints. In December 2016, the NTSB closed the recommendation, classifying the FAA response as ‘unacceptable action’.

Research and recommendations in Canada

In Canada, regulatory requirements for UTRs were less comprehensive than in the United States and Australia in the 1980s. In 1987, the Canadian Aviation Safety Board (CASB) conducted a study on UTRs. It concluded that pilots of small aircraft had the responsibility to assist passengers in the event of an accident, and therefore they should be properly restrained. The CASB therefore issued recommendation CASB 87-58 to the Department of Transport, requiring the installation of UTRs, where practicable, in the flight crew seats of all commercial aircraft, regardless of their date of manufacture.

The Canadian National Aeronautical Establishment conducted a literary review of research and development in crashworthiness of general aviation aircraft seats, restraints and floor structures with the results published in February 1990.^[81] The report concluded:

An effective way to increase occupant protection in G.A. [general aviation] aircraft in survivable crashes is the promotion of education for the usage and maintenance of currently installed seat and shoulder harnesses. Several studies have shown that the percentage of usage of installed shoulder harnesses is only about 40%. The installation of shoulder harnesses about (60% of G.A. aircraft seats do not have shoulder harnesses) would provide an immediate benefit. Retrofit work entails engineering design of attachment points for the many different models of G.A. aircraft in use. Retrofit kits are available for some G.A. aircraft.

In 1992, following an investigation into a fatal seaplane accident, the Transportation Safety Board (TSB) of Canada (which replaced the CASB in 1990) issued the following recommendation:

A92-01: The Department of Transport expedite legislation to require the use of a seat-belt and shoulder harness during take-off and landing of small, commercial fixed-wing aircraft.

In 1994, the TSB conducted an analysis of seaplane accidents that occurred during 1976–1990. During this period, there were 1,432 accidents with 452 fatalities.^[82] The aim of the study was to examine occupant survivability in seaplane accidents; therefore, the scope included 103 accidents where the aircraft terminated in the water. The study’s conclusions included:

Failure to successfully exit a sinking aircraft is common for persons who suffer a trauma sustained because of a lack of appropriate restraint at the time of the accident. Yet, few occupants of seaplanes involved in water-accidents had taken advantage of available upper-torso restraint. Even pilots, who are more aware of the importance of being adequately restrained during an accident, and who are responsible for assisting survivors to exit the stricken aircraft after an accident, were often not using the shoulder harnesses that were available...

Although the majority of fatal seaplane accidents in the water involve drowning, approximately one-tenth of these victims were incapacitated from non-fatal impact forces. The availability and use of personal restraint systems could have facilitated a successful egress for many of these victims…

The TSB issued another recommendation:

A94-08: The Department of Transport require the fitment of lap belts and shoulder harnesses in seaplanes and require their use by all pilots during take-offs and landings before the 1995 seaplane season begins.

After recommendation A94-08 was issued, Transport Canada made changes to regulatory requirements similar to those previously introduced in the United States, requiring UTRs in all front seats, and UTRs in all other seats of small aeroplanes manufactured after 12 December 1986.

Upon completion of these changes, the TSB classified the response to these recommendations as satisfactory.

The loss of control and collision with water of a De Havilland DHC-2 in May 2012 again highlighted the benefits of UTRs for passengers.^[83] At the time of the accident, there were no modifications or supplemental type certificate (STC) to incorporate UTRs into this particular aircraft type and therefore no UTRs had been fitted to the rear passenger seats. The rear-seat passenger’s head struck the pilot’s seat, rendering the passenger unconscious, which resulted in drowning.

The TSB noted that the intent of its previous recommendations was not restricted to aircraft manufactured after December 1986. Consequently, the TSB made the following recommendation:

A13-03: The Department of Transport require that all seaplanes in commercial service certificated for 9 or fewer passengers be fitted with seatbelts that include shoulder harnesses on all passenger seats.

Transport Canada’s responses to this recommendation indicated that the redesign and structural modification of these particular types of aircraft would not be feasible for operators. Therefore, it would continue to mitigate through promotion and education. The TSB noted that there were UTR kits available for many of the 600 aircraft referenced by the recommendation, and it was feasible to retrofit other applicable aircraft. Accordingly, the TSB has classified the Transport Canada response as Unsatisfactory (as of September 2018), with the recommendation remaining active pending further responses from Transport Canada.

Research and recommendations in Europe

In 2001, the United Kingdom (UK) Air Accident Investigation Branch (AAIB) published a report on an accident that occurred in 1999 involving a Cessna Titan 404 near Glasgow in 1999.^[84] The accident resulted in eight fatalities and three serious injuries. Most of the injuries were chest injuries, and there were also some head injuries. The report noted that there was ‘clear evidence that these injuries were compounded by the separation and collapse of the seats and by the limitations of the passenger seats, where only a lap strap was available’.

At that time, there was a requirement in the UK all aeroplanes with a maximum take-off weight (MTOW) not greater than 5,700 kg and nine passenger seats or less to have a UTR in each passenger seat. However, this only applied for aircraft that had a certificate of airworthiness first issued on or after 1 February 1989. There was no equivalent requirement in in the European Joint Aviation Requirements (JARs) at that time, except for newly manufactured aircraft as of 11 March 1994 to have UTRs for all seats.

As a result of the accident, the AAIB issued the following recommendation to the UK Civil Aviation Authority (CAA):

Recommendation 2001-40: The increased statistical risk in operating FAR/JAR part 23 aircraft, in comparison with the larger FAR/JAR Part 25 ‘Transport Airplanes’, is a strong incentive to incorporate at least some of upgraded seat requirements into existing light aircraft fleet, particularly for those types continuing production. For example, dynamic testing has shown the advantages of fitting upper torso restraints. Similarly, it is possible for seat attachment fittings to be strengthened without imposing a requirement that the FAR/JAR 23.562 injury criteria be demonstrated.

It is therefore recommended the CAA should undertake a study to identify those elements of the current JAR-23 seat standards which may be used for retrofit into existing aeroplanes whose maximum certificated take-off mass is less than 5,700kg. And, separately, for those designs in continuing production which are not covered by the current JAR standards. These elements should then be applied at least to those that are operated in the Transport Category (Passenger).

The CAA accepted the recommendation and conducted a study. The study noted that, in terms of all the potential seat requirements, only the retrospective application of UTRs was worth pursuing. The study conducted a review of accident statistics and other information and concluded:

Upper Torso Restraint systems are widely recognized as a safety enhancing feature which can reduce the number of fatalities following a survivable accident and reduce the number of seriously injured and severity of those injuries. This recognition is reflected in the airworthiness standards of FAR/JAR/CS 23, which now include UTR as a mandatory requirement within the basic design codes.

While these enhancements have benefitted passenger protection on new aeroplanes, the existing fleet is not immediately affected, and accidents continue to occur where passengers may have benefitted if UTR systems had been fitted…

In the UK, retroactive requirements are conditional on the date of first registration. The UKCAA has analysed UK accidents data and estimated the potential life savings that could be achieved by fitting UTR to passenger seats on light aeroplanes on the UK register… The UK-CAA has also estimated the associated costs with modifying the fleet with such additional UTR.

Based on the UK experience, together with similar US experience that led to publication of FAR Part 23 Amendment 23-32, and with the belief that this experience is likely to be applicable throughout Europe, the UK-CAA has concluded that there is sufficient justification to include in JAR-26 a requirement to mandate the provision of Upper Torso Restraint systems to all aeroplanes engaged in Commercial Air Transportation operations.

It is recommended that this proposal be considered by Central JAA for publication as an NPA, with a view to it being adopted within JAR-26.

In 2005 an accident involving a Pilatus Britten-Norman BN2B-26 Islander occurred. The aircraft was engaged in an air ambulance task with a pilot and paramedic on board. Both the pilot and paramedic passenger were fatally injured, but had survived the initial impact. The AAIB investigation report^[85] released in 2006 identified that the aircraft was fitted with UTRs; however, the lap straps were not compatible with the shoulder harness attachment points. Therefore, there was no shoulder harness available to the paramedic passenger, nor was there a requirement to have one fitted by the operator at the time. The AAIB concluded that the paramedic was probably rendered unconscious in the impact when his head hit the pilot’s seat due to the lack of a UTR. He subsequently drowned.

As a result of this accident, the AAIB released the following recommendation:

Safety Recommendation 2006-101: The European Aviation Safety Agency [EASA] and Joint Aviation Authorities should review the UK Civil Aviation Authority’s proposal to mandate the fitment of Upper Torso Restraints on all seats of existing Transport Category (Passenger) aeroplanes below 5,700 kg being operated for public transport, and consider creating regulation to implement the intent of the proposal.

In 2011, EASA implemented changes to address the recommendation, which it summarised as follows:

The EASA Opinion 04/2011 on air operations, published 01 June 2011, requires aeroplanes with a maximum certificated take-off mass of less than 5700kg and with a maximum seating configuration of less than 9, operated for Commercial Air Transport (CAT), to be fitted with a seat belt with upper torso restraint system for each passenger seat. If the maximum passenger seating configuration is 9 or more, a seat belt but no upper torso restraint system is required [refer to paragraph CAT.IDE.A.205(a)(3) and (4)].

An amendment to the regulation was made to include a requirement to have aeroplanes within this category have a UTR fitted at each passenger seat by 8 April 2015.

In 2015, following an operator survey and an Air Operations Standardisation meeting, EASA made changes to this requirement and related requirements for flight crew seat restraints due to concerns expressed by some parties about the ability to meet the requirements for some aircraft types. Consequently, the requirement for UTRs was changed to be only applicable to aircraft with an initial individual Certificate of Airworthiness first issued on or after 8 April 2015.

Research and recommendations in Australia

In addition to the accident on 10 January 2017 involving VH-WTQ, during the period 1998–2018, there have been at least three other investigations involving passenger transport flights in Australia in small aeroplanes where the absence of UTRs has been raised:

• Investigation 199802830, Cessna 185E Floatplane, VH-HTS, Calabash Bay, NSW, 26 July 1998. During a go-around into a confined area, the aircraft departed from controlled flight and collided with terrain. The pilot and four passengers were fatally injured. The Bureau of Air Safety Investigation (BASI) report found that the pilot and the front-seat passenger were not wearing available UTRs. The other seats were not fitted with UTRs. The BASI report also noted that the type and severity of injuries sustained suggested that, had adequate lap belt and UTRs been fitted and worn, those features would have aided survivability.
• Investigation 200002157, Piper PA31-350 Chieftain, VH-MZK, Spencer Gulf, South Australia, 31 May 2000. During a passenger flight from Adelaide to Whyalla, both engines of the aircraft malfunctioned. As a result, the pilot ditched the aircraft into the Spencer Gulf. The pilot and all seven passengers died, mostly due to drowning. The report noted that the pilot, who was wearing a UTR, had minor impact-related injuries, even though he was sitting in that part of the aircraft that suffered the most structural damage. However, the passengers who only had lap belts received comparatively more severe impact-related injuries. The ATSB concluded that the absence of UTRs and life jackets or floatation devices reduced the chances of survival of the occupants.
• Investigation 200105446, Cessna 210N, VH-LMX, 11 km east-south-east of Kalgoorlie, Western Australia, 14 November 2001. During a passenger transport flight, the engine lost power. During the forced landing, the pilot lost control and the aircraft impacted terrain. The pilot was fatally injured and the three passengers were seriously injured. The front left of the aircraft was exposed to the full force of the ground impact. The passengers received various injuries. The report noted that the upper body and head injuries sustained by the passengers was probably due to the upper torso flailing contact with interior structure and objects, and fitting UTRs to the passenger seats may have reduced the exposure to some of the serious injuries incurred.

Following the 1998 accident, BASI issued Recommendation R19980281 to the Civil Aviation Safety Authority (CASA) in March 1999. The recommendation stated:

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority mandate the compliance of all manufacturers' service bulletins relating to the provision of upper body restraint to occupants of FAR part 23 certified aircraft engaged in fare-paying passenger operations, and emphasise compliance with their instructions on the correct use of the restraint systems.

Background information to the recommendation noted that:

An inspection of the Australian aircraft register revealed that the majority of light aircraft (FAR Part 23 certified) in Australia were manufactured prior to 12 December 1986. The major US aircraft manufacturers had ceased light aircraft production in the early to mid-1980s. Consequently, the protection afforded to passengers by the requirement for the provision of upper body restraint has not been extensively provided. Anecdotal evidence suggests that only a small percentage of these aircraft engaged in fare-paying passenger operations in this country meet the amended safety standard (FAR 23.2)…

On 4 September 1992, the Cessna Aircraft Company issued Single Engine Service Bulletin SEB92-28 "Seat belt and shoulder harness installation", which was applicable to all single-engine Cessna aeroplanes including the C185E…

An inspection of other US light aircraft manufacturers revealed the availability of similar installation kits…

General inquiries suggested that a small number of kits were imported at the time the service bulletins were issued. Most of these kits were installed in aircraft held at the time by distributors. Only a few aircraft owners wishing to provide greater protection for their passengers have since installed these kits…

By way of comparison, the requirement for upper body restraint (three-point harness) for rear-seat occupants in motor vehicles was introduced in accordance with Australian Design Rule (ADR) 5A. This was applicable to all new vehicles certified after 1 January 1971. A requirement for coaches greater than 5 tonnes to be fitted with upper body restraint for all occupants was introduced on 1 July 1994 by ADR 68/00.

As with many airworthiness directives, ADRs are not retrospectively applied. However, the much greater attrition rates for motor vehicles, compared to aircraft, means that compliance is achieved in a much shorter period…

Despite the availability of kits from most of the large manufacturers that enable aircraft owners to incorporate upper body restraint for all the passenger seats in many of the aircraft manufactured prior to the 12 December 1986, very few have been modified…

The provision of upper body restraint to all passengers in FAR part 23 aircraft has not been effective through the normal process of fleet attrition and replacement, as originally envisaged by the responsible regulatory authorities. Retrospective application was not mandated, for technical and economic reasons, even though manufacturers made available seat belt and harness installation kits for many of their previous models. Voluntary installation of kits by Certificate of Registration holders (aircraft owners) has not been widely adopted. This has resulted in the majority of the affected fare-paying passenger aircraft being operated without upper body restraint for all occupants, despite the safety enhancement that can be readily achieved by such modification.

CASA issued a Discussion Paper for a proposed regulatory change in 2001. In its assessment of the responses to the Discussion Paper, CASA noted:

Fifty-one responses to the Discussion Paper were received by CASA. Seventeen responses were clearly in favour of the proposal and 14 were clearly opposed. A common theme was that the cost of installation of shoulder harnesses in some aircraft would be significant. For example, at least one respondent advised that the cost to modify a Piper PA 31 aircraft in accordance with the Piper Service Bulletin would be approximately $100,000. Implementation in some aircraft would necessitate replacement of seats, and in some of those it is conceivable that floor strengthening would be required…

In view of the difficulty of estimating the true costs and benefits, CASA believes that proceeding with a comprehensive benefit-cost analysis is not warranted. In light of the significant costs CASA believes that action to mandate installation of shoulder harnesses in Australian aircraft carrying fare-paying passengers cannot be justified…

The installation and use of shoulder harnesses for all occupants in small aircraft will be strongly recommended to operators and the travelling public, and CASA will publicise the benefits of shoulder harnesses in this class of aircraft. This will be done in the expectation that the air-travelling public will become aware of the desirability of shoulder harnesses; and operators who can make this modification without threatening their economic viability will consider doing so.

The ATSB accepted CASA’s response and closed the recommendation. Its assessment of the CASA response stated:

While acknowledging the efforts of the Civil Aviation Safety Authority in responding to this recommendation, the Australian Transport Safety Bureau will continue to monitor occurrences involving occupant restraints.

In May 2019, the ATSB asked CASA about what guidance information it had provided operators and/or the travelling public either recommending the use of UTRs or advising of their benefits. CASA replied that, other than the Discussion Paper released in 2001, it could not identify any other guidance information it had provided.

As noted above, during the period 1998–2018, there were at least four accidents involving Australian passenger transport flights in small aeroplanes in Australia where the presence of UTRs in all passenger seats would have reduced the potential for fatal or serious injuries. The ATSB reviewed the other accidents in Australia during the 21 years between 1998–2018 that involved small aeroplanes being used for passenger transport operations to determine the extent to which UTRs were available in all passenger seats.

Overall, there were 20 accidents involving small aeroplanes with a seating capacity of three to 10 seats engaged in passenger transport operations that resulted in at least one serious or fatal injury. In these 20 accidents, almost all (18) of the aeroplanes were manufactured prior to December 1986, and therefore were not required to have UTRs fitted. For the 11-year period 1998–2011, all of the 13 aeroplanes involved were manufactured prior to December 1986. For the 10-year period 2009–2018, 5 of the 7 aeroplanes were manufactured prior to December 1986 and the other 2 were manufactured after December 1986.

The extent to which UTRs had been retrofitted to all seats in these aeroplanes was not noted in many of the investigation reports. However, where that information was available, it indicated that UTRs had not been retrofitted to all seats.

In addition to passenger transport flights, the ATSB has noted the benefits of UTRs in investigation reports into accidents involving aeroplanes which did not have UTRs fitted being used for other types of flights during 1998–2017 (for example, ATSB investigations AO-2014-068 and AO-2011-043). A review of a sample of other accidents in small aeroplanes during this period which resulted in fatal or serious injuries that involved small aeroplanes manufactured before December 1986 did not identify any aircraft that had been retrofitted with UTRs in all passenger seats.

The ATSB has also found that pilots or passengers in the front seats of small aeroplanes have not always worn the available UTRs, exacerbating the severity of their injuries in many accidents (for example, ATSB investigations 199800442, 200605133, AO-2010-053, AO-2012-083, AO‑2012‑142 and AO-2016-074).

The ATSB has also noted the benefits of UTRs in another investigation where a Gippsland Aeronautics GA-8 Airvan aircraft (manufactured in 2005) being used for a passenger charter flight was fitted with UTRs, which contributed to the passengers’ survival, with no serious injuries experienced (ATSB investigation AO-2010-080).

__________

57. Some but not all of the flights on 12 November 2016 were also recorded. Given that this day’s data was incomplete, it was not included in this analysis.
58. In general, a pilot’s documented flight time will be slightly larger than an aircraft’s recorded flight hours as pilot hours generally include taxi time.
59. The only exception to the flights from Agnes Water to a beach ALA in the GPS data occurred on 4 January 2017 and involved a 29-minute flight that departed from Agnes Water and returned to Agnes Water. This flight appeared to be included in the pilot’s logbook figures in addition to the other flights that day.
60. The estimate was made by taking the time from the first data point with a groundspeed higher than 50 km/h (27 kt) to the data point prior to when the groundspeed decreased below 50 km/h. A small number of discrepancies were identified and corrected where the aircraft was taxied with a recorded groundspeed above 50 km/h. The groundspeeds at each data point were based on the distance between the data point and the previous data point divided by the time interval.
61. The same pattern also existed from June to November 2016, but daily flights times had a wider range of values before June 2016. The only exceptions to the use of daily flight time figures in increments of 0.25 hours from November 2016 occurred on 2 January 2017 (0.6 hours) and 4 January 2017 (1.1 hours). The 2 January flights included 4 standard flights and 3 short flights between beach ALAs, with a total flight time of 0.7 hours (based on GPS data). The 4 January included 4 standard flights and 1 long scenic flight, with a total flight time of 1.1 hours (based on GPS data).
62. There were also multiple days in October and November 2016 (prior to 14 November) where there was flight time in VH-WTQ documented in the pilot’s logbook but no flight time documented on the maintenance release.
63. The aircraft had two hour meters. The figures discussed in this appendix were displayed on the Omron meter. The other hour meter displayed a figure at the time of the accident (5,452.2 hours) that did not match any of the documented hour meter readings.
64. CAO 100.5 (General requirements in respect of maintenance for all Australian aircraft) defined ‘time-in-service’ for an aircraft as ‘the time from when the aircraft leaves the ground on a flight until it touches the ground for the purpose of landing at the end of the flight’.
65. A maintenance release includes columns to record each daily flight time and a progressive total of the aircraft’s total time in service at the end of each day on which flying was conducted.
66. In the small number of cases where the maintenance release time exceeded the pilot logbook time, the flight hour figures were relatively large. This may have been due to multiple pilots flying the aircraft on those days.
67. This resulted in an underestimation figure of 19.5 per cent from 12 November 2015 to 12 November 2016, slightly less than the 20.4 per cent overall for the period from 12 November 2015 to the accident flight.
68. Secondary surveillance radar relies on an aircraft’s operational transponder transmitting a data signal in response to being interrogated by an air traffic service radar or another receiver (for example, another aircraft’s Traffic Alert and Collision Avoidance System). The amount of information transmitted in the data signal is dependent on the type of transponder in the aircraft. This can range from the aircraft’s altitude (Mode C) to the identification of the flight and the pilot selected cruising level (Mode S).
69. Part of the difference is probably because the recorded data for both sources were recorded with a resolution of 1 second, so data points could be up to 0.5 seconds apart, or about 32 m at 125 kt.
70. ‘QNH’ refers to the altimeter barometric pressure subscale setting used to indicate the height above mean seal level. Transponder altitude data is based on a standard QNH of 1,013.2 hPa, which was very slightly below the QNH measured at a nearby town (Seventeen Seventy) at 0900 (1,013.4 hPa). This would result in the transponder altitude reading about 6 ft too low. The ATSB corrected the transponder altitude for this analysis.
71. Photogrammetry: analysis of photographic images to obtain measurement data.
72. Heights of terrain features were obtained from both Google Earth and topographic maps downloaded from the Queensland Globe web site (qldglobe.information.qld.gov.au). The estimated height of trees on the ridge was included.
73. If the QNH setting on the aircraft is 1 hPA higher than the actual QNH, the altimeter will over read by about 30 ft.
74. National Transportation Safety Board 1980, The status of general aviation aircraft crashworthiness, Safety Report NTSB/SR-80/02.
75. Kirkham, WR Wicks, SM & Lowrey, DL 1982, Crashworthiness studies: Cabin, seat, restraint, and injury findings in selected general aviation accidents, Federal Aviation Administration Technical Report FAA-AN-82-7.
76. National Transportation Safety Board 2005, General aviation crashworthiness project: Phase two – Impact severity and potential injury prevention in general aviation accidents, Safety Report NTSB/SR-85/01.
77. Colangelo EJ & Russell JC 1989, Injuries to seat occupants of light airplanes, US Department of Transportation Technical Report DOT/FAA/AM-89/3.
78. Federal Aviation Administration, Aviation Safety Alaskan Region 2010, Fatal and serious injury accidents in Alaska: A retrospective of the years 2004 through 2009 with special emphasis on post crash survival.
79. Rostykus PC, Cummings P & Mueller BA 1998, ‘Risk factors for pilot fatalities in general aviation airplane crash landings’, Journal of the American Medical Association, vol. 280, pp.997-999.
80. National Transportation Safety Board 2011, Airbag performance in general aviation restraint systems, Safety Study NTSB/SS-11/01.
81. Huculak P 1990, A review of research and development in crashworthiness of general aviation aircraft: Seats, restraints and floor structures, National Aeronautical Establishment, Aeronautical Note NAE-AN-64.
82. Transportation Safety Board of Canada 1994, A safety study of survivability in seaplane accidents, Report number SA9401.
83. Transportation Safety Board of Canada, Loss of control and collision with water: Cochrane Air Service De Havilland DHC-2 MK.1, C-FGBF, Lillabelle Lake, Ontario, 25 May 2012, Aviation Investigation Report A12O0071.
84. Air Accidents Investigation Branch 2006, Report on the accident to Cessna 404 Titan, G-ILGW, Near Glasgow Airport on 3 September 1999, Aircraft Accident Report 2/2001.
85. Air Accidents Investigation Branch 2006, Report on the accident to Pilatus Britten-Norman BN2B-26 Islander, GBOMG, West-north-west of Campbeltown Airport, Scotland on 15 March 2005, Aircraft Accident Report 2/2006.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 4 January 2017, a Boeing 737-8FE, registered VH-VUH (VUH) and operated by Virgin Australia Airlines Pty Ltd (Virgin) was holding on B3 taxiway at Brisbane Airport, Queensland, when the crew heard a loud noise from what they thought was a burst tyre on the left main landing gear wheel. The crew attempted to return the aircraft to the gate, but were held short of the gate when an attending engineer observed that the number one main wheel assembly (left hand outboard wheel) had failed.

What the ATSB found

The ATSB found that the number one main wheel ruptured due to tie bolt assemblies that had loosened while in service. This allowed the two wheel halves to move relative to each other, resulting in a fatigue crack and eventual wheel rupture. The loosening was most likely due to the presence of anti-seize compound between the wheel halves, which affected the clamping forces.

The ATSB also found that while tie bolt assemblies on this wheel-type (single-web) were more prone to in-service loosening than dual-web wheels, there were no mandated inspections suitable for detecting such loosening. There were also no mandated risk controls to prevent loosening or subsequent rupture.

What's been done as a result

Virgin advised that following this occurrence, regular inspections were implemented to identify and prevent the loosening of tie bolt assemblies.

The wheel manufacturer updated the wheel’s component maintenance manual with more detailed instructions for applying anti-seize compound.

Boeing has advised the 737 NG fleet of the issue and suggested two possible courses of action. These were based on two optional service bulletins that the manufacturer had in place prior to the occurrence:

• incorporation of a new inner half-wheel that allows for safe deflation if tie bolt assemblies loosen (Service Bulletin C20626-32-014)
• the addition of lockwire to the tie bolt nuts, to prevent loosening in the first place (Service Bulletin C20626-32-016).

Safety Message

This incident highlights the importance of compliance with all aspects of manufacturers’ maintenance procedures, including the appropriate application of anti‑seize. This is especially important if, as in this case, there is no simple means of detecting the effect that such excess product can have on fastener security.

The occurrence

What happened

On 4 January 2017, a Boeing 737-8FE, registered VH-VUH (VUH) and operated by Virgin Australia Pty Ltd (Virgin), was scheduled to fly from Brisbane, Queensland to Melbourne, Victoria. Prior to take off, at approximately 1710 Eastern Standard Time,^[1] VUH was holding on B3 taxiway when one of the main wheels experienced what was believed to be a burst tyre. The flight crew began to taxi the aircraft back to the gate. An attending engineer instructed the flight crew to stop the aircraft before reaching the gate, as they noticed the number one main wheel assembly (left‑hand outboard wheel) had failed (Figure 1).

Figure 1: Damage to the number one main wheel assembly on VUH

Source: Virgin Australia

The flight was cancelled and passengers disembarked, however, the aircraft could not be jacked and towed via the axle due to the damaged wheel. Instead, wing jacks were sourced and a double wheel change performed on the tarmac. The aircraft was then towed to a maintenance facility for examination.

An inspection at the maintenance facility found that the inner half of the wheel assembly had fractured (see the section titled Wheel design). The tie bolt assemblies that connected the two halves of the wheel were all present with mating faces intact, however some of the bolts were found to be loose.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.

Context

Wheel design

This particular wheel-type was designed for use on Boeing 737 NG aircraft. At the time of publication, the wheel manufacturer, Safran Landing Systems, estimated that approximately 2,000 aircraft were using the wheel globally. The wheel assembly used an asymmetric single-web^[2] design, with both axle bearings contained within the outer half-wheel (Figure 2). Eighteen tie bolt assemblies connected wheel halves together, with the inner half-wheel attached to the axle only via the tie bolts and outer half-wheel. This asymmetric design allowed for larger brake assemblies to fit within the wheel, unlike dual-web designs where each half-wheel contains an axle bearing.

As a result of the asymmetry, the tie bolts were exposed to a more cyclic load profile (compared with a more symmetrical design). The forces in the bolt could potentially oscillate with the rotation of the wheel while in service.

In this incident, the failed wheel was one of the outboard wheels on the aircraft and a hubcap normally covered the tie bolt assemblies.

Figure 2: Cross section of the main wheel showing the fracture initiation point

Source: Manufacturer, modified by the ATSB

The fracture location was coincident with a region of high stress during service. As seen in Figure 2, the cross section of the inner half-wheel reduced in thickness from left to right. The fracture occurred at the point where its cross section was thinnest, and near a change in geometry (tie bolt hole).

ATSB examination

The wheel halves from the ruptured assembly were initially sent to the ATSB for examination, where the following was found:

• Twelve of the 18 tie bolt assemblies could be twisted by hand.
• Several of the nuts had noticeably backed off the thread, with only three of the remaining six nuts above the minimum torque of 163 Nm.
• The breakaway torque^[3] of each nut was tested, and four of the 18 nuts were below the acceptable value of 3.61 Nm.
• The tie bolt assemblies were visually inspected and found to be the correct part in every instance, with no evidence of damage.
• A region of the fracture surface near one of the tie bolt holes exhibited fatigue crack progression (beach) marks radiating away from several initiation points (Figures 3 and 4). The remainder of the fracture was consistent with shear overstress. There was no visual indication of material defect at the fatigue crack initiation sites.

Figure 3: Outboard fracture surface on the inner half-wheel, with a fatigue region

Source: ATSB

Figure 4: Fracture morphology of one of the fatigue cracks through the fractured inner half-wheel

Source: ATSB

Manufacturer’s examination

The wheel manufacturer conducted a further examination of the failed main wheel, including a detailed analysis of the fracture morphology. They concluded that the wheel failed as a result of the observed fatigue cracks propagating into a mixed fatigue/ductile rupture mode. A small crack was also detected within the adjacent tie bolt hole, although this did not appear to have contributed to the wheel failure.

The manufacturer verified that the material composition and dimensions of the wheel were within specifications. Their report did not speculate on possible causes or factors contributing to the initiation or propagation of the observed fatigue cracking. However, they subsequently indicated that there was excessive ‘interposition product’ (anti-seize compound in this case) at the mating face of the occurrence wheel halves and that:

The presence of interposition product could lead to loss of bolt tension and then wheel rupture.

Specifically, it was believed that this interposition product prevented the wheel halves from abutting squarely against each other during assembly. Relative movement of the halves during service then resulted in loosening of the tie bolt assemblies and ultimately failure of the wheel. The manufacturer advised that the same mechanism was believed to have caused wheel failure in this type of wheel in two other instances (see the section titled Previous occurrences).

In March 2018, the wheel manufacturer visited the two different maintenance facilities responsible for Virgin’s 737 NG fleet to examine how the wheels were being maintained. Both facilities were following the tightening technique recommended by the manufacturer. However, at one facility the manufacturer reported seeing silicone grease on the mating faces of some of the wheel halves. This facility did not perform any maintenance on the occurrence wheel, and a subsequent visit by the manufacturer in September 2019 found that the grease was being applied appropriately.

Wheel history and maintenance

The occurrence wheel had undergone three tyre changes since its initial assembly in January 2016. It had operated for 173 cycles (47 days) since its last tyre change. According to one of the maintenance facilities responsible for the work, tie bolt assemblies generally lasted about three to four tyre changes before the lock nuts failed their breakaway torque tests and needed to be replaced. A tyre generally lasted approximately 40 days in service before needing replacement.

When reassembling the wheel after a tyre change, the tie bolt assemblies were tightened using a two-stage process, starting with an automatic dual spindle wrench. This device automatically torqued diametrically opposing nuts to a pre-set value of 70 Nm. In the second stage, the maintenance facility would use a single electronic torque/angle wrench for the final tightening. This involved rotating the nuts 100 degrees, as prescribed in the component maintenance manual (CMM). The wrench then indicated with a coloured light whether each nut was in the acceptable torque range.

This second stage was a relatively new tightening method introduced in 2014 via an optional service bulletin (SB C20626-32-007), to ‘improve wheel tie bolt clamping forces… and improve prevention against corrosion’. The service bulletin also recommended a new type of anti-seize compound, which was adopted by the maintenance facility prior to the occurrence. Following the occurrence, this new tightening method was made mandatory.

Prior to the occurrence, the manufacturer had updated the CMM to explicitly prohibit the application of any product to the mating faces of the wheel halves. Illustrations were included to demonstrate the proper application of anti-seize compound. A warning message regarding lubricant on the mating faces was also engraved on the wheels themselves. Since the occurrence, one of the maintenance facilities reported a change in nut design had resulted in fewer nuts failing their breakaway torque check.

Eddy current inspections^[4] of the outer and inner wheel halves were mandated every tyre change. However, the CMM indicated that these were localised to the bead seat area of the wheel. These inspections would therefore not identify the fatigue cracks observed in this occurrence, which were at a different location. General inspections of Virgin wheels were performed every six tyre changes. These inspections included a visual inspection of each wheel half and dye penetrant inspection. It is not clear whether these tests would have revealed cracking such as that found in this occurrence. Regardless, the wheel ruptured after three tyre changes, so the inspection had not yet been performed.

Operator inspections for loose tie bolts

Following the main wheel failure, Virgin performed a fleet-wide inspection on this wheel-type. Two other wheels in service at that time had tie bolts loose enough to be moved by hand. One of these wheels was relatively new, and had not yet required a tyre change.

As another post-incident preventative safety measure, the maintenance facilities applied torque seal to all tie bolt assemblies after each tyre change. The torque seal provided a visual indication of loosening tie bolt assemblies without any additional equipment. All wheels were also inspected at regular intervals, with the longest time between inspections being 28 days in service. This interval was selected so that the majority of wheels would be inspected at least once before a tyre change (approximately 40 days in service).

When a wheel was found with broken torque seals, the wheels and tie bolt assemblies were visually inspected for damage and their breakaway torques were tested. Nuts were replaced if they failed their torque check and undamaged assemblies were put back into service. No other loose tie bolts were found following the initial fleet inspections until July 2017. From July 2017 to August 2018, the wheel inspections found:

• ten more wheels with at least one broken torque seal, including six with multiple broken torque seals
• broken torque seals on wheels that had come from each of Virgin’s maintenance facilities
• three wheels exhibiting tie bolts with broken torque seal, despite being above the minimum allowable torque
• one instance where a tie bolt with unbroken torque seal was below the minimum allowable torque.

The bolt with unbroken torque seal could indicate that not all tie bolt assemblies left the maintenance facilities with the appropriate torque. Conversely, the broken torque seals on correctly torqued nuts serve as confirmation the tie bolt assemblies loosened in service despite being appropriately tightened.

Since September 2018, there have been no more broken torque seals found during Virgin’s inspections.

Boeing advice on tie bolts loosening in service

In 2018, Boeing released a bulletin to its fleet, recognising several wheel failures involving this type of wheel and acknowledging that it was the result of tie bolt assemblies loosening in service. The publication stated:

As the nuts unscrew from the bolts, the wheel halves start to separate under the influence of tire pressure and ground loads. Eventually the wheel halves flex to a sufficient amount that the wheel ruptures…

The bulletin also stated:

The mechanism that causes the nuts to unscrew is not well understood and has been difficult to reproduce on a dynamometer during lab testing.

The bulletin described wheel-types from two different manufacturers, however both wheels had a similar single-web design, with the axle bearings contained within one wheel half. Boeing believed that the issue was unique to these two wheel-types. The bulletin stated that if the preload was ‘less-than-optimal, the nuts may start backing out, or ’unscrew’ from the bolts as the wheel rolls under load.’ Boeing identified two issues that were associated with loosening. From the digest:

Bolt preload. Strict adherence to the bolt/nut tightening procedures has been shown to minimize the likelihood of bolt loosening.

Bolt thread lubricant. Testing and in-service experience has shown that certain thread lubricants are more likely than others to result in nut loosening.

Wheel manufacturer service bulletins

The wheel manufacturer released two optional service bulletins that mitigated the likelihood or consequence of tie bolts loosening in service.

The first bulletin was released prior to the occurrence in July 2016, to ‘ease main wheel deflation in case of broken or missing tie bolts’ (SB C20626-32-014). This had not been implemented on the ruptured wheel. The service bulletin introduced a replacement for the inner half-wheel. The new part included grooves along the mating face of the half-wheel, so that any movement between the two halves would allow air to escape and result in the gradual deflation of the wheel. Based on estimations from the manufacturer, the new half-wheel currently has a 55-60 per cent adoption rate, on a global stock of approximately 12,000 in-service wheels.

The second service bulletin added lockwire on to the tie bolt assemblies to prevent any loosening while in service (SB C20626-32-016). This bulletin was released on 4 January 2018, however the wheel manufacturer advised that bulletin was not released in response to this occurrence.

Previous occurrences

The wheel manufacturer advised that globally, there have been three other cases in which this type of wheel has fractured, and in each case the manufacturer assessed that the fracture initiated from a loss of bolt tension. In two of those three cases, the manufacturer believed the loss of bolt tension was caused by interposition product (grease or anti-seize compound) between the mating faces of the wheel. VUH was the first and only occurrence in Australia (noting that Virgin and Qantas use this wheel-type on their 737 NG fleet).

While the number of wheel failures is known, the number of instances of loosening tie bolt assemblies could not be determined or accurately estimated. CMM instructions for disassembling the wheel did not include any instruction on recording bolt torque or inspecting for loose bolts. Instances of loosening tie bolts in Virgin’s fleet have been recorded since the occurrence, but in the global fleet the numbers are unknown.

__________

2. The manufacturer described the design as single-web, because the web region connecting the axle bearings to the rim is only contained in the outer half-wheel. Dual-web designs have a web between the bearing and rim on both wheel halves.
3. Breakaway torque measures the locking force of the nut. It is the torque required to loosen a nut that has been run onto a tie bolt.
4. Eddy current testing involves using a magnetic field to induce a current in the material being inspected. This is known as an eddy current. Defects or cracks in this material can then be identified, as they may manifest as a measurable change in the eddy current.

Safety analysis

Occurrence event

The location of fatigue crack initiation in the wheel was coincident with areas of high service stress and there was no evidence of corrosion or manufacturing defect. A majority of the tie bolt assemblies on the fractured wheel were found to be loose, and nuts were found to be backing off on appropriately-torqued tie bolt assemblies on other wheels during service. Previous occurrences of wheel fracture have also been associated with loss of bolt tension. It was therefore most likely that tie bolt assemblies loosening in service resulted in the fatigue cracking and rupture of VUH’s left main wheel.

The loose tie bolt assemblies were likely a result of interposition product (grease or anti-seize compound) on the mating faces of the wheel halves. This prevented the halves from abutting squarely against one another when tightening the tie bolt assemblies. The wheel halves were then able to move relative to one another while in service, causing the tie bolt assemblies to loosen, reducing the clamping forces and inducing cyclic stresses.

Prevention or detection of tie bolt loosening

All of the possible reasons Boeing and the wheel manufacturer provided for the wheel ruptures related to having a suboptimal clamping force between the two hub halves, resulting in the failure mechanism described above. Prior to this occurrence, the wheel manufacturer had updated the component maintenance manual to explicitly prohibit interposition product between wheel halves. That update did not prevent this occurrence and the operator had 12 further instances of tie bolts loosening in service. However, since the manufacturer visited both of the organisations maintaining Virgin’s wheels, they have had no additional occurrences.

While actively preventing interposition product between the wheel halves appears to have been effective at reducing instances of loose tie bolts, there are other mechanisms that could reduce wheel clamping force. For example, since the occurrence there has been at least one instance of a wheel entering service with a bolt that was below the minimum required torque. Clamping force will also be affected by broken or missing tie bolts, which was the hazard addressed by the manufacturer through the introduction of hub grooves for safe tyre deflation.

At the time of publication there were no mandatory inspections capable of reliably detecting loose or missing tie bolt assemblies in service, between tyre changes. Those on the outer main wheels would not be readily observable due to the presence of a hubcap. In the absence of inspections, the two optional service bulletins (grooves for safe deflation, and lockwire on the tie bolt nuts) existed to prevent wheel ruptures and subsequent adverse outcomes, however their optional nature reduced the service bulletins’ effectiveness as risk controls.

Findings

From the evidence available, the following findings are made with respect to the main landing gear wheel failure of Boeing 737-8FE, registered VH-VUH, at Brisbane Airport, Queensland on 4 January, 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• A majority of the wheel's tie bolt assemblies loosened while in service, likely due to grease or anti-seize compound between the mating wheel halves. This resulted in fatigue cracking and ultimately, wheel rupture.
• The tie bolt assemblies on this wheel-type (single-web) were more prone than dual-web wheels to loosening during service, however there were no inspections for detecting loose tie bolt assemblies in service and no effective mandated risk controls to prevent wheel rupture.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Virgin Australia Airlines Pty Ltd
• Ground crew at Brisbane Airport
• Airservices Australia
• Main landing gear wheel manufacturer
• Wheel maintenance providers.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Virgin Australia Airlines Pty Ltd, the main landing gear wheel manufacturer, the wheel maintenance providers, Boeing, the Civil Aviation Safety Authority (CASA), the French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA), and the National Transportation Safety Board (NTSB).

Submissions were received from the main landing gear wheel manufacturer, the wheel maintenance providers, CASA, and the BEA. The submissions were reviewed and, where considered appropriate, the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 2 January 2017, the pilot of a Van’s RV-6A aircraft, registered VH-TJM, conducted a private local flight from Starke Field aircraft landing area (ALA), Queensland. At about 1029 Eastern Standard Time (EST), after a flight of about 85 minutes, the aircraft approached to land at the ALA on runway 15. The aircraft landed heavily, bounced back into the air, and as it contacted the ground again, the nose landing gear collapsed. The propeller struck the runway and the aircraft nosed over and came to rest inverted. The pilot and passenger were seriously injured, and the aircraft sustained substantial damage (Figure 1).

Figure 1: Accident site showing damage to VH-TJM

Source: Queensland Police

Structures Study

In response to an accident that occurred on 12 August 2005 in Alaska USA, in which a Van’s RV-9A aircraft nosed over during the landing roll and sustained substantial damage, the US National Transportation Safety Board (NTSB) conducted a finite element analysis (FEA) of the nose gear strut and fork from the Van’s Aircraft series RV-6A, -7A, -8A and -9A. The study examined data from 18 previous accidents and one incident in which a Van’s aircraft became inverted during landing. In all cases, the nose gear struts and forks made contact with the ground, initiating the damage sequence. The FEA concluded that the nose gear strut had sufficient strength to perform its intended function.

The report also found that the risk of the fork contacting the runway surface was increased by:

• poor piloting technique
• bounced landings
• low tyre pressure
• heavier engine/propeller weights
• forward centre of gravity
• heavy braking
• runway condition – soft or undulating ground, high grass and depressions of objects on the runway.

The aircraft manufacturer subsequently increased the ground clearance of the nose gear fork by about 2.5 cm (1 inch). The Van’s Aircraft service letter in response to the structures study describes the revisions to the nose gear leg design.

Video footage

Footage from a video recording device, mounted on the underside of the aircraft’s fuselage, showed that the aircraft landed heavily on the initial touchdown. The nose wheel touched very soon after the main wheels and started to vibrate (or shimmy). The aircraft then bounced back into the air and the nose landing gear was still vibrating fore and aft. The nose landing gear was aft of its neutral position when it contacted the ground the second time, just before the main wheels touched again. With that impact, the nose landing gear fork bent and the nose landing gear folded under itself. The aircraft then nosed over.

Figure 2: Landing sequence with collapse of nose landing gear

Source: Video footage supplied by Queensland Police

Safety analysis

Flight data

The ATSB analysed the recorded flight data from the aircraft’s avionics system for the incident flight. Figure 3 shows the final minute of the flight as the aircraft descended from about 600 ft above ground level. At 1029:21, the wind changed from 335° at 5 kt to 098° at 7 kt, the aircraft encountered a crosswind of 6 kt and the tailwind, which had been about 4 kt reduced to about 1 kt. The vertical speed at that time was about 1,100 ft per minute.

At 1029:38, the aircraft first contacted the ground, at an airspeed of about 75 kt, with a tailwind of 2 kt and descending at about 700 ft per minute.

Figure 3: Flight data extract

Source: Aircraft owner

The aircraft had a stall speed^[1] of 48 kt without flaps and 43 kt with 40 degrees of flap, therefore the aircraft landed at about 1.6 times the published stall speed. The normal approach speed for an aircraft is about 1.3 times the stall speed in the landing configuration. The high rate of descent and speed relative to the ground at landing probably contributed to the nose landing gear collapse.

The airstrip operator commented that the preferred landing direction was to the south-east (runway 15) particularly in crosswind conditions, due to trees and a road at the southern end of the runway. This may have contributed to the pilot’s decision to land on runway 15, albeit with a light tailwind.

The pilot had flown the aircraft to be hangered at that airfield about two weeks prior to the incident, so had limited experience landing on the runway.

The NTSB Structures Study found the nose landing gear strut had sufficient strength for its intended function. The study also identified a number of operational factors and local conditions that may contribute to Van’s RV nose-over occurrences. While the ATSB did not perform a detailed analysis into the nose gear failure, factors such as the bounced landing and runway condition were probably relevant to this occurrence.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The aircraft landed heavily at a high rate of descent and groundspeed, with the nose wheel touching down very soon after the main wheels. This probably led to the nose landing gear collapsing.

Aviation Short Investigations Bulletin - Issue 59

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The published stall speed for the aircraft type is the minimum speed at which the aircraft is controllable in the landing configuration (at maximum landing weight).