Investigation summary

What happened

On 28 March 2025, the Sky Aces formation aerobatics team, which consisted of 4 Pitts‑type aircraft operated by Paul Bennet Airshows, was performing a display at the Avalon Australian International Airshow, at Avalon Airport, Victoria. A Pitts S1-11X, registered VH‑PVX, was one of the 4 aircraft. 

During the aerobatic display, the pilot of VH-PVX entered a triple avalanche manoeuvre, which is a loop with 3 snap rolls at the top. The pilot completed the snap rolls, then attempted to complete the loop. The aircraft collided with the ground resulting in substantial damage to the aircraft and serious injuries to the pilot.

What the ATSB found

The ATSB found that the aircraft had a lower nose attitude during the snap rolls, which was likely a result of starting the first half of the loop 100 ft lower than the previous commencement height of 200 ft. While the snap rolls were commenced at approximately 800 ft, which was similar to comparison flights, the low nose attitude limited the aircraft’s ability to climb and resulted in the pilot finishing the snap rolls at about 200 ft lower. From the lower height, the pilot then completed the final part of the loop, with insufficient height to safely recover from.

The ATSB also identified several factors that increased the emergency response times to reach the pilot. Although it was unlikely that this additional time affected the consequences of the pilot’s injuries, these factors could, however, affect survivability in a similar circumstance.

What has been done as a result

The event organiser is in the process of redesigning the pyrotechnic area for future airshows to provide clearly identified routes of entry for emergency services to safely access the pyrotechnic field if necessary. This will involve updating transport and emergency management plans, as well as providing briefings to all emergency services agencies and onsite personnel. The organiser will also adopt similar requirements for aerobatic displays to those instituted by the United Kingdom Civil Aviation Authority, with exceptions provided on a case-by-case approval. These include minimum height requirements based on aircraft performance and pilots having ‘gate’ parameters or check altitudes set for all critical junctures of an aerobatic manoeuvre. Further, the organiser is proposing to stage an ambulance with the Aviation Rescue Fire Fighting Services to reduce accident response times.

Safety message

The accident highlights that, although the nature of low-level aerobatics is a high-risk activity, those who participate in these activities can reduce risk by using personal minimum safe heights. This may include:

• setting and adhering to minimum safe heights for the commencement of manoeuvres
• confirming the aircraft’s height before commencing a manoeuvre 
• confirming height prior to reaching a point of no return and having an exit strategy if the height is below the pilot’s minimum
• undertaking regular reviews of your own and other team members’ in-flight video recordings and engaging in regular debriefing of these, particularly checking that selected minimum commencement height are adequate.

Additionally, any risks identified that may impact the emergency response, should have appropriate controls put in place to ensure responders can act quickly and effectively.

The investigation

The occurrence

On the afternoon of 28 March 2025, the Sky Aces formation aerobatics team, which consisted of 4 Pitts‑type aircraft operated by Paul Bennet Airshows, were performing a display at the Avalon Australian International Airshow, at Avalon Airport, Victoria. The 4‑ship¹ formation included the Pitts S1‑11X aircraft registered VH‑PVX.

VH-PVX and another aircraft became airborne at about 1710 local time. At about 1715, the pilot of VH‑PVX departed the formation, to start a solo routine. During this solo routine, the pilot planned to complete an aerobatic manoeuvre known as a triple avalanche. The triple avalanche was a combination of a loop with 3 snap rolls² at the top (Figure 1). The snap rolls were entered and exited from an inverted position.

Figure 1: A successful triple avalanche manoeuvre performed by the pilot in VH‑PVX on 26 March 2025

This is a still image extracted from a video recording of the validation flight (see Validation flight). Source: AMDA, annotated by the ATSB

The pilot entered the first half of the loop from approximately 100 ft above ground level (AGL) (see Recorded information). At the top of the loop, while in an inverted position, the altimeter showed that the aircraft was approximately 800 ft. The pilot then initiated 3 snap rolls, during which the aircraft drifted toward the show line (see Air display information). The pilot finished the snap rolls inverted with the aircraft banked away from the show line. They then began the descending part of the loop, however, they had insufficient height to recover. At about 1717, the aircraft collided with terrain, resulting in substantial damage to the aircraft (Figure 2).

The aircraft came to rest upright, west of runway 18/36, within an area that had been designated for fireworks and other pyrotechnics. The pyrotechnic team members were first to arrive at the accident site. They reported a strong smell of fuel and extricated the pilot from the aircraft. The Aviation Rescue Fire Fighting Service (ARFFS)³ arrived a short time later. The pilot was airlifted to hospital and sustained serious injuries. They reported that they had no recollection of conducting the accident manoeuvre.

Figure 2: Aircraft wreckage

Source: ATSB

Context

Pilot information

The pilot held a Commercial Pilot Licence (Aeroplane) issued in 1999, and a current class 2 aviation medical certificate, which was suitable for the operation type. They completed a single-engine private instrument rating in August 2023, which fulfilled the requirements of a single-engine flight review. The pilot’s logbook showed they had approximately 2,248 hours of total flight experience. 

The pilot had a formation aerobatics flight activity rating issued in 2015 and was approved to conduct aerobatics without an altitude restriction. They held design feature endorsements including tailwheel and manual propeller pitch control, which were required to operate the aircraft. 

The pilot had competed in aerobatic championships and reported that they had flown with the lead pilot since approximately 2002. More recently they had flown as a part‑time member of the Sky Aces aerobatic team.

Operator information

The operator, Paul Bennet Airshows, was a specialist in aerobatic flying and vintage aircraft displays. They were commonly invited to take part in airshows across Australia and internationally. The Sky Aces formation team had performed at multiple airshows prior to performing at Avalon. In preparation for the Avalon airshow, the Sky Ace formation group practised their routine and completed the flight validation required by the event organiser (see Validation flight).

Aircraft information

General 

The Pitts S1-11X aircraft was a single-seat aerobatic, amateur-built biplane, modified from the Pitts S1-11B, and constructed in Germany in 2010 by Wulf (Wolf) Aircraft. It was powered by a Ly-Con AEIO-540-EXP experimental engine and fitted with a 3-bladed, MTV-6 constant-speed propeller of laminated wood construction. The wings were predominantly made of timber with a fabric covering. They were externally braced against each other and the fuselage using a series of flying wires, landing wires, interplane struts, cabane struts⁴ and incidence wires. The aircraft type did not have wing flaps fitted and all wings had ailerons. The landing gear consisted of left and right forward main gear and a small tailwheel at the rear. The aircraft was a combination of fabric‑covered wood and metal, as well as composite materials, and was designed for unlimited aerobatics up to +/-10 g.5

VH-PVX (Figure 3) was first registered in Australia in 2015 and issued with a special certificate of airworthiness in the experimental category.⁶ It had been operated by Paul Bennet Airshows since that time. 

Figure 3: VH-PVX at Avalon Airshow prior to the accident

Source: Aircountry

Maintenance

The aircraft was maintained as per Civil Aviation Safety Authority Schedule 5 of the Civil Aviation Regulations and required a periodic inspection every 100 hours or 12 months, whichever came first. The most recent periodic inspection was conducted by an authorised maintenance organisation on 28 February 2025. At the time of the accident, the aircraft had accumulated 303 hours total time in service, about 5 hours of which were since the previous periodic inspection. There were no defects listed on the aircraft maintenance release.⁷

Altimeter accuracy

In February 2025 the aircraft’s altimeter accuracy was checked during a periodic inspection and found to be within allowable limits. Additionally, about 3 minutes before the accident, the onboard camera showed the aircraft’s altimeter reading approximately 1,200 ft, which was consistent with the automatic dependent surveillance‑broadcast⁸ (ADS‑B) altitude of 1,214 ft above mean sea level recorded for another of the formation aircraft operating at a similar altitude as VH‑PVX. Flight data was not available for VH‑PVX on this flight.⁹

Canopy

VH-PVX was fitted with a side‑opening canopy. There were no instructions for opening the canopy visible on the outside of the aircraft (Figure 4 top image). This was contrary to the Civil Aviation Safety Authority Civil Aviation Order 101.28 Airworthiness certification requirements – Amateur-built category aeroplanes, section 3.27 Markings and placards that stated markings were required: 

…on both the outside and inside of each exit door, hatch or canopy, indicating the position of the opening handles with locks fully engaged and also providing essential operating instructions for opening.

An example of such instructions on another aircraft is shown in Figure 4 (bottom image). 

Figure 4: Outside of canopy on VH-PVX (top image) compared with a different aircraft showing opening instructions (bottom image)

Source: ATSB

The operator reported emergency services and pyrotechnicians were provided with extraction details prior to every airshow.

Meteorological information

The Bureau of Meteorology provided automated weather observations taken at 1-minute intervals at Avalon Airport during the aerobatic display. Between 1710 and 1717, the highest recorded windspeed was 5 kt with gusts up to 6 kt. The temperature was 30°C, visibility was greater than 10 km, and the atmospheric pressure ranged from 1015‍‍–‍1014 hPa for the period. 

Recorded information

Flight data was recovered from an onboard accelerometer unit fitted to the aircraft. The unit recorded elapsed time and acceleration g‑forces, but the data was inconsistent with the flight behaviour. Therefore, it was not used in the analysis. Various sources of video that captured the accident flight were available, so video analysis techniques were employed to generate flight path estimates of the aircraft during the accident manoeuvre.

The in-cockpit camera recording was found to be the most suitable source for the video analysis. It recorded a partial view of the instrument panel, the back of the pilot and view of the outside. Various features visible in the video with known locations were analysed using commercial camera tracking software¹⁰ to determine the path of the camera. Specifically, it produced information on the aircraft latitude, longitude and height above ground for each frame, which was used to create an estimated flight path.

The operator also provided the ATSB with 2 videos from the cockpit of VH-PVX that were recorded with the same pilot flying at a previous airshow. These videos were recorded on a GoPro camera in a similar, but not the same, position as the accident flight (over the pilot’s left shoulder). An analysis of these videos and the accident flight is discussed below. 

Aerobatic manoeuvre

Standard process

The pilot described the normal process they would use to complete the triple avalanche manoeuvre, which included the first half of a loop followed by 3 snap rolls and then the final part of the loop (Figure 1). They stated they would normally enter the loop pulling about 4–5 g, then gradually reduce the g toward the top of the loop to start the snap rolls with a slight nose up attitude. Through the process of completing the snap rolls, it was possible for the aircraft to laterally cross the intended show line (see Air display information). In this circumstance, the pilot reported they usually checked the ground position immediately following the completion of the snap rolls and made corrections if they were no longer aligned with the show line. The pilot indicated their personal minimum height for commencing the snap rolls was 1,000 ft AGL. 

Previous flights

In the 2 previous videos provided, the onboard altimeter showed that the pilot began the first half of the loop at 200 ft AGL, began the snap rolls at 800 ft, and finished the snap rolls at 1,200 ft in one instance and at 1,000 ft in the other. In both videos, the pilot completed the final half of the loop and recovered to straight and level flight above 200 ft.

Also, in the first video, the nose attitude of the aircraft appeared to be further above the horizon at the beginning of the snap rolls when compared with the second video. This resulted in more height gained during the snap rolls in the first video. Prior to commencing the snap rolls, the aircraft appeared to be in a nose up attitude. When the pilot commenced the snap rolls the aircraft continued along a similar trajectory in the direction the aircraft’s nose was pointing before the snap rolls were commenced. That is, when the aircraft nose was pointing above the horizon prior to the snap rolls, the aircraft continued in an upward direction while performing the snap rolls. 

Accident flight

Loop entry height

During the accident flight, the onboard altimeter was visible prior to commencing the snap rolls at 800 ft and just prior to the collision with terrain at 100 ft. However, it was not visible during the entry to the loop, or at the completion of the snap rolls.

Therefore, to establish the height the pilot entered the first half of the loop, the ATSB used a combination of the ATSB’s estimated flight path, the aircraft’s altimeter (when in view of the camera) and the height of the aircraft during other low-level passes throughout the display. Table 1 provides this information at various stages of the accident manoeuvre. Figure 5 is a simplified recreation of the path the aircraft flew on the accident flight and the comparison flights. 

Table 1: VH-PVX manoeuvre sequence

There were discrepancies between the estimated height and the onboard altimeter. Such as during the descent, at 0.4 seconds (Figure 5 D) before the collision with terrain, the altimeter showed 100 ft AGL. At that point, the ATSB estimated height was 47 ft. Although, it was possible that the altimeter was lagging the actual height of the aircraft for the short time it was visible due to the descent rate.

However, it was noted that the low-level passes performed during the display and when the altimeter was visible, the aircraft instrument indicated the pilot was flying at approximately 100 ft. Therefore, it was determined that the entry height to the first part of the loop was likely to be about 100 ft. This was 100 ft lower than seen in the comparison flights.

Figure 5: Comparison of the previous and accident flights, showing the nose attitude when reaching 800 ft when starting the first part of the loop at different heights

The reference points A, B, C, D refer to Table 1. Source: ATSB

Snap roll height gain

As seen in the previous flights, the aircraft gained approximately 200–400 ft during the snap rolls. This allowed the pilot to start the recovery (final part of the loop) from no lower than 1,000 ft. However, the estimated flight path showed that in the accident flight, this was not achieved.

While there was some margin of error due to the available data sources, the ATSB recreation of the flight path from the onboard video estimated that only around 14 ft of height was gained during the snap rolls.

Attitude comparison

The ATSB compared the aircraft’s nose attitude during the snap rolls in the accident flight with the comparison flights. As the exact position, orientation and settings of the cameras varied between the 3 videos, the ATSB was unable to make a quantitative assessment of the difference in attitude between each of the flights. However, a visual comparison of the videos indicated a noticeable difference in attitude between the accident and comparison flights (Figure 6, Figure 7). Additionally, when the pilot reviewed the onboard video recording of the accident flight with the ATSB, they identified that the nose was low on the first snap roll. 

Figure 6 shows the accident flight nose attitude is closer to the horizon when starting the snap rolls than seen in the comparison flight. Figure 7 shows that the accident flight finishes the snap rolls with a lower nose attitude than the comparison flight. Although, it is harder to make a comparison in this image due to the bank angle on the accident flight.

Figure 6: Aircraft’s nose attitude when starting the snap rolls for the accident flight (top image) and a comparison flight (bottom image)

Source: Operator, annotated by the ATSB

Figure 7: Aircraft's nose attitude when finishing the snap rolls for the accident flight (top image) and a comparison flight (bottom image)

Source: Operator, annotated by the ATSB

Final loop segment and recovery

To recover from the triple avalanche, the pilot needed to have sufficient height after the snap rolls to complete the final part of the loop without entering an aerodynamic stall or colliding with terrain. The comparison flights showed this height increase could be achieved during the snap rolls.

Summary of comparison flights 

Table 2 provides a summary of the comparisons made across the 3 videos supplied by the operator.

Table 2: Summary of comparison data

Wreckage and impact information 

The aircraft collided with terrain on a grassed area west of runway 18/36, in a location of the airport designated as the pyrotechnic box (seeAir display information). In this area, there were multiple pyrotechnics ready to be used in the Sky Aces show, along with many boxes of fuel that were planned to be ignited during the ‘wall of fire’ display later that evening.

A ground scar, approximately 95 m long, was on a south-south-west heading (Figure 8). The aircraft tumbled around the nose and came to rest upright and oriented toward north, almost opposite the direction of the impact sequence and debris trail. The initial impact point occurred about 10 m from the fuel boxes within the pyrotechnics (Figure 8).

Figure 8: Overview of pyrotechnics and point of VH-PVX collision with terrain

Source: Royal Australian Air Force No 1 Security Forces Squadron, annotated by the ATSB

An image taken from the onboard camera showed that the aircraft was in close proximity to the pyrotechnics before (Figure 9) and at the point of the collision with terrain. 

Figure 9: VH-PVX just prior to collision with terrain showing proximity to pyrotechnics

Source: ATSB

The ATSB conducted a preliminary examination of the aircraft at the accident site, but due to access restrictions for the operational airport and airshow, the wreckage was then relocated to a secure facility for detailed examination. Examination of the wreckage identified:

• There was no evidence of any defects or failures that may have been present before the impact, and which could have contributed to the development of the accident.
• The uppermost section of the canopy windshield was fractured partly from the accident sequence and then from first responders accessing the cockpit.
• The engine mounts had fractured, with the engine remaining tethered by the main fuel line, engine controls and wiring loom. 
• The propeller hub remained attached to the engine and fragmentation of the propeller blades was indicative of the engine providing power at the time of the collision.
• The forward main landing gear had permanently splayed outward, the tailwheel strut exhibited some upward deflection, the engine sump cover had fractured, and the lower fuselage section had sustained compression damage, consistent with a hard landing in an upright orientation.
• The upper wings had separated from the aircraft, with the wing spars fracturing outboard of the cabane strut attachment. The lower wings sustained impact damage but remained secured to the fuselage.
• The rigid lines between the fuel tanks and selector valve were fractured, resulting in post-accident leakage of fuel. However, the fuel tanks remained intact and there was no post-impact fire.

Air display information

General

Held every 2 years over 6 days, the Avalon Australian International Airshow combined Australia’s largest aviation, aerospace and defence industry trade exposition with a 3-day airshow. The event was organised by the AMDA Foundation (AMDA), which was the chosen name to reflect the consolidation of Aerospace Australia Limited and Industry Defence and Security Australia Limited.

AMDA provided a briefing on airshow operations and safety to all airshow pilots prior to the airshow. This included the expected timetable of display events, pilot responsibilities, display area information, manoeuvre limitations, minimum heights, minimum weather conditions and holding areas. It also included a brief of the emergency procedures and airshow terminology that would be used to terminate displays in the event of an emergency.

Event operations centre

AMDA had created an emergency response plan, which stated:

The priority of the EOC [event operations centre] Manager and Chief Warden in an emergency is to support the emergency control agency and provide clear communication to the Area Wardens within each event zone.

The emergency response plan defined a potential or declared emergency as:

An emergency is when there is a potential incident or incident that could be beyond the ability of the normal day to day management structure. An emergency is described as any incident that:

• Has the potential to cause or is causing loss of life and extensive damage to property, infrastructure or the environment.

• Has the potential to have or is having a significant adverse consequence for the Airshow event, guests, staff and aircrews.

• Requires the involvement of two or more emergency control agencies to respond to a class of emergency as defined in the Emergency Management Act 2013.

     - Class 1 Emergency

     - Class 2 Emergency

It further stated the roles and responsibilities of the event operations centre as follows:

The EOC Manager is required to monitor activity across the precinct and deploy additional resources to assist or deal with incidents as they are reported or identified through CCTV or the AMDA Call Centre.

These include managing critical security, medical or safety incidents which may require a higher level of resources, real time monitoring or a significant management focus. These incidents can occur multiple areas and require deployment of specialised or centrally managed resources.

The EOC Manager is responsible for delegating roles and responsibilities within the EOC to ensure appropriate resources are managing each incident and can escalate to Victoria Police as required.

Designated areas

Designated areas were mapped on Avalon Airport to assist in segregating the airshow from spectators. The airshow had several displays that used pyrotechnics, including the Sky Aces routine. The pyrotechnics detonation area was located to the west of runway 18/36 inside the flight display area. Show lines were created to assist aircraft with conducting displays at an appropriate distance from the crowd (150 m, 250 m, 350 m and 500 m). The show line to which a display could be performed to, was determined by the aircraft’s speed during the display. Cameras were placed on each show line and monitored to ensure aircraft were conducting their displays at a safe distance from the spectators (Figure 10).

Figure 10: Avalon Airport designated areas

Source: AMDA, annotated by the ATSB

The display pilot briefing provided by AMDA stated that aircraft with a maximum display speed between 101 kt and 200 kt could conduct their display as close to the crowd as the 150 m show line. At the time of the accident manoeuvre, the pilot was performing at about 160 kt and performing close to the 150 m show line.

During the snap rolls, the aircraft moved towards the 150 m show line. When the pilot reviewed the accident video, they believed they attempted to correct this, which was also evident from the show line video (Figure 11).

Figure 11: VH-PVX reference to 150 m show line, shows the aircraft moving towards the show line, then away from the line

The image is made from several images overlaid on each other to show the sequence of VH-PVX. The VH-PVX label shows the first position of the aircraft in the manoeuvre sequence. Source: AMDA, annotated by the ATSB

Validation flight 

AMDA required that participants in the airshow successfully complete a validation flight prior to the public display. On 26 March 2025, the Sky Aces formation team satisfied this requirement, which involved the pilot completing their solo display including the accident manoeuvre in VH-PVX. The validation report had not noted any concerns about the routine or ability of those involved to successfully perform it on the day of the show. There was no comparison video available as evidence of the heights the manoeuvre was performed at during the validation flight.

Event risk assessment

AMDA conducted a risk assessment for the airshow and identified multiple hazards.  Some of the associated risks identified that were relevant to the accident included:

• pyrotechnic display operator injured/killed by aircraft wreckage and/or flare debris impact into pyrotechnic area during airshow

• aircraft/vehicle malfunction or crash during atypical flying display

• vehicle or aircraft transits across the pyro [pyrotechnic] box bursting or igniting flammable liquid explosives

• blocking ARFF [Aviation Rescue Fire Fighting Services] route out of the fire station (Figure 12) with resultant impact on ARFF emergency response times. 

Risk controls were implemented by AMDA to reduce either the likelihood or consequences of the identified hazards, which included:

• pyrotechnics placed outside the runway strip
• minimising pyrotechnician personnel in the pyrotechnic area during the airshow
• a briefing provided to airshow pilots
• having emergency services in attendance including ARFFS
• AMDA’s emergency response plan
• pilots flying in displays were experienced and were required to complete a validation flight.

To ensure taxiway Foxtrot (Figure 12) remained clear for ARFFS units leaving the southern fire station in an emergency, aircraft movements to/from the southern tarmac were controlled by Airservices Australia air traffic control.

Figure 12: Avalon Airport taxiway and ARFFS southern location 

Source: Airservices Australia and Google Earth, annotated by the ATSB

Furthermore, Ambulance Victoria (AV) was contracted to attend the airshow to perform the following roles:

• to manage the pre-hospital impacts of the event through on-site AV resources and transport capability (if required)

• to mitigate the impact of the event on AV’s service delivery to the surrounding community; and

• to ensure that if an incident occurs at the event which evolves into a major emergency, there is an AV presence on-site to manage the pre-hospital response and emergency medical treatment as required, rapidly and effectively.

Survival aspects

Emergency response

An emergency response was activated at 1717 following the accident. Table 3 shows the sequence of events of the emergency response.

At 1718, the pyrotechnicians were first to arrive onsite. The pyrotechnicians were trained in first aid and were able to extricate the pilot from the aircraft, which they determined was necessary due to the strong smell of fuel and their assessment of a possible subsequent fire.

The pyrotechnicians reported having difficulties in opening the aircraft’s canopy, as the opening mechanism was not obvious from the outside. The onboard video showed that the pyrotechnicians took approximately 50 seconds to forcefully remove the canopy, which appeared to have already been damaged in the accident sequence.

At the same time, the ‘crash alarm’ was activated by the air traffic controller and the ARFFS dispatched 2 tenders¹¹ from the southern fire station and one tender from a temporary northern dispatch area. The northern ARFFS response tender crew reported they were unable to use taxiway Bravo while trying to access the accident site as a departing air transport flight was obstructing the taxiway. Instead, the crew opted to use the airport perimeter track and reached the accident site at approximately the same time as the ARFFS tenders responding from the southern side. The ARFFS reported increased response times due to the accident occurring inside the pyrotechnics area and navigating the associated hazards to ensure the safety of the responders. 

When the accident occurred, AV ambulances were already on location at the airshow. However, AV reported that their response time was impacted due to the need to wait for an escort to the scene as the airport remained active to assist with landing of the other formation aircraft. Avalon Airport and AMDA reported the delay was due to the escort waiting for the ambulance to make safe access. The ATSB could not verify the difference in these accounts, but the first ambulance arrived onsite at 1731.

Table 3: Emergency response sequence

Pilot injuries

The pilot sustained serious head, chest, abdominal, spinal and leg injuries requiring hospitalisation and long-term rehabilitation. The pilot was wearing a 5-point restraint and a cloth flying cap. 

ATSB analysis based on estimates of aircraft speed, impact angle, attitude, and energy absorption, indicated that the vertical acceleration experienced by the pilot would normally result in serious injuries, in addition to moderate to serious injuries from the horizontal component. 

The tail wheel was the initial impact point followed by the main landing gear, underside of the fuselage, fuel control unit and propeller. During that initial impact, the pilot’s seat crushed 5–8 cm into the fuselage, as the main landing gear spread, distorting the lower fuselage and fracturing the airframe. The pilot’s spinal injuries were almost certainly the result of the vertical impact forces. The gascolator (fuel strainer), located directly beneath the pilot’s seat, pierced the seat base and cushion, but its contribution to the pilot’s injuries could not be determined. 

The pilot’s left leg injury was consistent with crushing of the footwell during the impact sequence. 

After the initial impact, the aircraft tumbled around the nose (Figure 13), destroying the wings and propeller. The pilot was effectively retained in their seat by the 5-point restraint, minimising flail injuries, and the space around the pilot in the cockpit was retained. However, the canopy fractured and was associated with a superficial scalp injury. Had the pilot been wearing a hard-shell helmet, that injury would probably have been avoided, but it would unlikely have reduced the severity of other injuries. 

Figure 13: VH-PVX during the accident sequence

Source: David Caird, Herald Sun

Safety analysis

Introduction

The pilot of VH-PVX was conducting low level aerobatics at the Avalon International Airshow when it collided with terrain, resulting in serious injuries to the pilot and substantial damage to the aircraft. 

This analysis will examine the accident flight manoeuvre compared with previous flights. Additionally, the ATSB also reviewed elements of the emergency response, which, although not contributing to the accident, could have resulted in increased severity of injuries in a similar occurrence.

Lower manoeuvre height

The accident pilot had previously completed the triple avalanche manoeuvre (the accident manoeuvre) in VH-PVX. Video evidence showed on at least 2 previous occasions the pilot began the manoeuvre at 200 ft above ground level (AGL), started the snap rolls at approximately 800 ft, gained height during the snap rolls and recovered the aircraft. Conversely, the combined analysis of the accident video and flight path estimated by the ATSB showed that the pilot likely began the manoeuvre at approximately 100 ft, started the snap rolls at about 800 ft, but did not gain height throughout the rolls. Although the pilot stated their minimum was 1,000 ft for starting the snap rolls, all 3 flights showed the manoeuvre starting at 800 ft.

A comparison across the 3 flights indicated that, throughout the snap rolls, the nose attitude was comparatively lower or flatter during the accident flight. This was supported by the pilot’s observations when watching the accident flight onboard video. The lower nose attitude was likely a result of starting the first half of the loop 100 ft lower than the previous commencement height of 200 ft. That is, the extra 100 ft available to the pilot in the first half of the loop meant that the aircraft would have been further through the loop by the time they had reached 800 ft and was therefore in a flatter trajectory. As a result, an estimated 14 ft of height was gained during the snap rolls rather than 200–400 ft as achieved for the previous flights with a higher nose attitude.

As the pilot was unable to recall the events of the accident, it was unclear if they were aware of the reduced height when entering the final part of the loop. However, the onboard video and subsequent collision with terrain showed that the pilot elected to continue the manoeuvre although the aircraft did not gain height during the snap rolls. Consequently, there was insufficient height remaining to complete the manoeuvre before colliding with terrain.

Emergency response

Given the location of the flight display area, it was likely that any accident involving a display aircraft operating to the 150 m, 250 m, or 350 m show lines would occur inside the pyrotechnics area. Therefore, due to the increased risk associated with the pyrotechnics, the emergency crew response times were increased as they navigated the dangerous area while operating on an active airport. 

For example, the Aviation Rescue Fire Fighting Service had to assess the hazards associated with the pyrotechnics to ensure the safety of their personnel and one tender had to use an alternative route to the accident site due to a departing aircraft. Likewise, although ambulances were already in attendance at the airshow, it took approximately 14 minutes for them to arrive at the accident site. Ambulance Victoria reported increased response times due to requiring escorts to reach the accident site, however, it was not clear how long ambulances were stationary waiting for an escort.

In addition, the aircraft did not have instructions on how to unlatch the cockpit canopy from the outside, as required for airworthiness certification. However, first responders managed to pull the canopy open in approximately 50 seconds after they arrived onsite. Instructions for opening the canopy may have reduced this time.

Some of these factors could have reduced the time taken to provide assistance to the pilot. However, on this occasion, the pyrotechnicians extracted the pilot from the cockpit, preventing injuries resulting from a possible fire and ARFFS attended to the pilot within 4 minutes of the accident. Therefore, it was unlikely that the severity of the pilot’s injuries were increased due to the location of the accident.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Wolf Pitts S1-11X, VH-PVX, Avalon Airport, Victoria, on 28 March 2025.

Contributing factors

• The triple avalanche manoeuvre was likely initiated at a lower height than on previous occasions resulting in a lower nose attitude when commencing the snap rolls at 800 ft, which was also lower than the pilot’s designated height. As result, the aircraft did not gain sufficient height during the snap rolls to recover from the loop before colliding with terrain.

Other findings

• While not likely contributing to the severity of the pilot’s injuries, several factors increased the time taken to respond to the accident, including:

- the co‑location of the flight display area with the pyrotechnic detonation area

- the Aviation Rescue Fire Fighting Service had to assess and then safely navigate the pyrotechnics area

- Ambulance Victoria had to wait for safe access to the accident site

- the aircraft did not have visible markings on the outside about how to open the canopy.

Safety actions

Safety action taken by AMDA (the event organiser)

The event organiser reported pyrotechnic area locations that would be fit-for-purpose would still likely result in future possible airshow accidents occurring in the pyrotechnic area. However, it was in the process of redesigning the pyrotechnic area for future airshows to provide clearly identified routes of entry for emergency services to safely access the pyrotechnic field if necessary. This would involve updating transport and emergency management plans, as well as providing briefings to all emergency services agencies and onsite personnel.

The event organiser will adopt similar requirements for aerobatic displays to those instituted by the United Kingdom Civil Aviation Authority with exceptions provided on a case-by-case approval. These include minimum height requirements based on aircraft performance. Additionally, pilots will also be required to have ‘gate’ parameters or check altitudes set for all critical junctures of an aerobatic manoeuvre, such as the apex of a loop and before committing to ‘pulling through the vertical’ to continue the manoeuvre.

Further, AMDA is proposing to stage an ambulance with the ARFFS to reduce response times for any similar future accidents.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of the accident aircraft
• the lead pilot of the formation
• the airshow event organiser
• the maintenance organisation for VH-PVX
• accident witnesses
• video footage of the accident flight and other photographs and videos taken on the day of the accident 
• Airservices Australia
• Avalon Airport
• Bureau of Meteorology
• Civil Aviation Safety Authority
• Ambulance Victoria.

References

Civil Aviation Safety Authority. (2004). Civil Aviation Orders 101.28 – Airworthiness certification requirements – Amateur-built category aeroplanes.  https://www.legislation.gov.au/F2005B00951/latest/text

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the pilot of the accident aircraft
• the other pilots within the formation team
• the airshow event organiser
• Airservices Australia
• Ambulance Victoria
• Avalon Airport
• Civil Aviation Safety Authority
• the maintenance organisation. 

Submissions were received from:

• another pilot in the formation team
• airshow event organiser
• Ambulance Victoria
• Avalon Airport.

The submission were reviewed and, where considered appropriate, the text of the report was amended accordingly. 

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2026 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

1. ^    Ship: refers to multiple aircraft flying in formation together. The preceding number refers to the number of aircraft in the formation.
2. ^    Snap roll: an aerobatic manoeuvre, which results in the aircraft making one revolution about its longitudinal axis with the aircraft aerodynamically stalled. An aerodynamic stall occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.
3. ^    ARFFS: Aviation Rescue Fire Fighting Service provides rescue and firefighting services at select airports within Australia.
4. ^    The cabane struts connect the upper wings connection to the fuselage and form part of the overall bracing scheme.
5. ^    ‘g’ is an abbreviation for the acceleration due to the earth’s gravity. A positive acceleration equal to 10 times the earth’s gravity is described as +10 g.
6. ^    Experimental category: the Civil Aviation Safety Authority can issue experimental certificates to allow specific operations of aircraft, which are not by their nature type certificated or have modifications incorporated that are not yet approved.
7. ^    Maintenance release: an official document, issued by an authorised person as described in Regulations, which is required to be carried on an aircraft as an ongoing record of its time in service and airworthiness status. Subject to conditions, a maintenance release is valid for a set period, nominally 100 hours time in service or 12 months from issue.
8. ^    Automatic dependent surveillance‑broadcast equipment transmits real-time operational data from an aircraft’s global positioning system and pressure-sensitive altimeter, which enables air traffic service providers to track aircraft. Airservices Australia recorded the transmissions received by its network of ADS-B receivers. That data could also be received by privately-operated equipment used to feed information to flight tracking websites.
9. ^    It is common practice during formation flying for only one aircraft to broadcast its position.
10. ^   SynthEyes is a program for 3D camera tracking, also known as match-moving.
11. ^   Airport tenders are specialised fire engines that carry large amounts of water, foam and other rescue equipment.

Investigation summary

What happened

On the afternoon of 1 December 2024, a Boeing 737-838, registered VH-XZK, was being operated by Qantas on a scheduled passenger service from Perth, Western Australia, to Sydney, New South Wales. As the aircraft neared Sydney the flight crew were advised that the airport was not accepting arrivals due to storms in the area. The flight crew diverted to Canberra Airport, Australian Capital Territory, with the intention of continuing to Sydney once the airport reopened.

After the aircraft arrived in Canberra, an error was made within the Qantas departure control system that resulted in 51 passengers being incorrectly listed as not on board the aircraft. A loadsheet[1] was created using the incorrect passenger information that contained a weight that was 4,291 kg less than the actual weight of the aircraft. The erroneous loadsheet was issued to the flight crew who used it to make performance calculations for the take-off. The flight crew were not advised of the error until after the aircraft had departed Canberra.

What the ATSB found

The ATSB identified that a minor data input error resulted in an automatic, and undetected, reduction in the number of passengers allocated to the flight. This error cascaded and erroneous passenger information was used by Qantas airport personnel to close the flight, and Qantas load control personnel to create the loadsheet.

Qantas airport personnel had later identified the issue but were unable to rectify the passenger error and did not advise load control. It was also found that although load control personnel held concerns about the validity of the data, and had attempted to understand it, the erroneous loadsheet was issued to the flight crew without resolution. 

The error was identified by load control personnel before the aircraft had departed, and they raised the error with Qantas airport movement control. After that point communication procedures were not followed, and Qantas airport personnel were not successful in communicating the error to the flight crew prior to departure.

What has been done as a result

Qantas has amended its procedures to include a requirement for airport personnel to conduct a headcount when a passenger discrepancy is identified. Qantas has also revised its procedures for communicating critical flight information to flight crew and will implement a new procedure that allows load control personnel to contact flight crew directly via the aircraft communications addressing and reporting system when a loadsheet error is identified. Additionally, local briefings have been issued to Canberra Airport personnel communicating handover requirements, and diversion flight handling scenarios.

Safety message

This occurrence highlights the importance of proactively identifying, addressing, and, when necessary, escalating unusual situations. It is not sufficient to rely on downstream controls or other functions to intervene or trap errors. It also reinforces the value of clear and effective communication with feedback, and adherence to defined procedures.

Demonstrating the value of prudent flight planning, the safety margins built into the performance calculations by the flight crew meant that their reliance on the incorrect data did not lead to an adverse outcome. 

The investigation

The occurrence

Diversion to Canberra

On the afternoon of 1 December 2024, a Boeing 737-838, registered VH-XZK, was being operated by Qantas on a scheduled passenger service from Perth, Western Australia, to Sydney, New South Wales. There were 2 flight crew, 4 cabin crew and 172 passengers on board.

Figure 1: Boeing 737-838 VH-XZK

Source: Victor Pody 

As the aircraft neared Sydney Airport, the flight crew were advised that the airport would not be accepting arrivals for about one hour due to storms in the vicinity. Rather than holding until the storms cleared, the flight crew diverted to Canberra Airport, Australian Capital Territory, with the intention of continuing to Sydney Airport once it reopened. The passengers would remain on board the aircraft in Canberra, and it would be refuelled for the short flight to Sydney.

At about 1516, the aircraft arrived at gate 9 at Canberra Airport. On arrival it was identified that there were 17 passengers whose final destination was Canberra. These passengers were permitted to disembark the aircraft, leaving 155 passengers remaining on board for the flight to Sydney. 

The flight from Canberra to Sydney required the operator to update flight information within their departure control system. That information was to be provided to the flight crew for flight planning. 

Canberra to Sydney flight creation

For the aircraft to continue to Sydney, a customer journey lead (CJL) needed to issue a new flight, known as an ‘addstop’, for the Canberra to Sydney sector in the Altéa Inventory (inventory) system[2] (see Departure control system and Customer journey management). 

When issuing the addstop for the flight, the CJL identified that it did not have an assigned aircraft configuration code. As a result, they looked up the code for the Boeing 737, which was 73RA01, but they inadvertently entered the code for the Boeing 717, which was 71RA01, and committed (locked) the flight. The Boeing 737 had a maximum seating capacity of 176 passengers, which was composed of 12 business seats and 164 economy seats, and the Boeing 717 had a maximum seating capacity of 125 passengers with no business seating. 

There were 11 business and 161 economy passengers on board the aircraft when it arrived in Canberra. When the CJL committed the flight with the incorrect configuration code, the system automatically offloaded[3] all 11 business class passengers and placed between 40 and 57 passengers[4] on standby[5] due to the reduced capacity of the Boeing 717.

The CJL recalled that they knew the Boeing 737 was the correct aircraft for the flight, and the incorrect code was the result of a typing error. They also recalled experiencing a high workload at the time due to an unusually large number of diversions and they felt pressure to complete the addstop ‘as quickly as possible’. 

Prior to committing the flight, the system would have presented the CJL with a dialogue box, caused by the Boeing 717 not having business seating, that required them to check and acknowledge the change (Figure 2). While the CJL recalled that the inventory system would present a number of automated pop-ups that needed to be accepted, they did not specifically recount sighting or accepting the class matching dialogue box. 

Figure 2: Amadeus Altea Inventory system class change dialogue box

Source: Qantas

The CJL identified the aircraft configuration code error almost immediately after committing the change, and they escalated the matter to their manager, and then to the load control systems manager (LCSM) to unlock the flight. The LCSM was the only person within the organisation who held the necessary permissions to unlock the inventory system.

At about 1526, the CJL contacted the LCSM and requested assistance to unlock the system so that the correct aircraft configuration code could be entered. The CJL contacted the LCSM again at about 1532. The LCSM was off duty at the time and away from their home. The LCSM returned home and unlocked the system using their laptop. 

The CJL corrected the aircraft configuration code for a Boeing 737 and re-committed the flight. However, the CJL had not realised that  the inventory system had automatically offloaded some passengers from the flight and placed others on standby due to the reduced passenger capacity of the Boeing 717 (see Customer journey management). 

Canberra Airport activities

The Qantas airport duty manager (ADM), who was overseeing the ground activities for the aircraft in Canberra, noticed that the new addstop flight to Sydney was unusually slow to show in the Altéa Customer Management (CM) system (see Departure control system). Between 1519 and 1600, the ADM attempted to establish the status of the addstop by calling the CJL, the load control operations leader (LOCO), and the integrated operations centre (IOC) and was advised that there was an issue with the flight in the system. 

At about 1632, the ADM was advised by the IOC that the issue had been partially resolved. Once the Canberra to Sydney addstop flight became available to the ADM in the CM system, they made adjustments to reflect the offloaded 17 passengers who were disembarking the aircraft in Canberra, all of whom had occupied an economy seat. The ADM then undertook a ‘mass boarding’[6] of the remaining passengers, in accordance with Qantas procedures, and closed the flight. At about 1646, the ADM issued the ‘passenger clearance’ for the flight and the ‘ramp clearance’ was issued at about the same time (see Ramp and passenger clearance). 

A short time later, an airport customer service agent (CSA 1) advised the ADM that there were passengers listed as standby for the flight. The ADM recalled that it was unusual for a diversion flight to have standby passengers and they were not aware of this when they closed the flight. At that time, 11 passengers had been offloaded, and 40 were listed as standby, resulting in a total of 51 passengers not recorded as on board the aircraft when the flight was closed.

The ADM recalled attempting to onboard the standby passengers within the CM system but was not successful. They recalled assuming the problem was related to the earlier issues with the addstop flight. They also recalled thinking that load control would already be aware of the issue, based on earlier telephone conversations with the LOCO where they had discussed the number of disembarking passengers, and that they would be able to rectify the problem prior to issuing the loadsheet. The ADM did not contact the LOCO.

Load control activities

The LOCO commenced the creation of the addstop loadsheet within the Altéa Flight Management (FM) system once the correct aircraft configuration code had been entered by the CJL (see Departure control system). At that time, the LOCO was in contact with the LCSM by telephone and they soon identified that the incorrect code had caused changes to be made to the loading documentation for the aircraft. This had resulted in a significant discrepancy between the number of passengers on board the flight from Perth and the number of passengers on the addstop flight to Sydney. 

Over a period of about 35 minutes, both the LOCO and the LCSM attempted to understand the information. This included contacting the Canberra ADM to confirm the number of passengers that had disembarked the aircraft as well as the fuel usage for the previous flight. The LOCO recalled they did not understand the issue or how to resolve the discrepancy and discussed the matter with the LCSM. They recalled the LCSM advised them to go with the passenger figure within the system as it had been confirmed by Qantas airport personnel. 

At about 1702, the LOCO issued the flight crew the provisional loadsheet and the final loadsheet for the flight simultaneously despite having ongoing concerns about the validity of the information (see Loadsheet). About one minute later the LCSM, who was still examining the loading information for the flight, identified the standby passengers within the system and advised the LOCO of the error.

Communication of loadsheet error

The LOCO initially attempted to contact the captain by mobile phone to inform them of the loadsheet error, but the call went unanswered. At about 1704, the LOCO contacted the Canberra airport movement control officer (MOCO) and advised them that the loadsheet was incorrect and the aircraft was not to depart (see Load control loadsheet error communication procedures).

The MOCO recalled that they attempted to contact the flight crew via radio, but they did not receive a response. The captain recalled they turned off the company frequency on receipt of the final loadsheet to reduce distractions while they entered the data and generated the take-off speeds. 

The MOCO then radioed a customer service agent (CSA 2), who was at the aircraft door with the flight’s customer service manager (CSM) at the time. The CSA 2 recalled discussing the loadsheet with the CSM, and they believed the CSM had also overheard the radio communications about the matter. The CSA 2 also recalled seeing the CSM enter the flight deck shortly after the discussion and believed the message had been passed to the flight crew. 

A short time later the CSM advised the CSA 2 that the doors could be closed, and the aircraft would be departing. However, the CSM reported that they did not receive a message from the CSA 2 about the loadsheet and, as a result, had not advised the flight crew of an error.

At about 1705, after providing instructions to the CSA 2 to contact the crew, the MOCO went on a scheduled break when advised to do so by the ADM. No handover was completed prior to the MOCO going on break as they believed the ADM was already aware of the loadsheet issue. However, the ADM recalled they had no awareness of the error at that time. 

Aircraft departure 

The error in the final loadsheet resulted in a calculated weight that was 4,291 kg less than the actual weight of the aircraft. The flight crew used this erroneous weight to make performance calculations for the take-off (see Loadsheet error and performance implications). 

The captain noted that the passenger figure within the loadsheet had reduced from the flight from Perth, but recalled that the CSM had made them aware that some passengers would be leaving the aircraft as their final destination was Canberra. They also recalled observing a line of people departing the aircraft. On receipt of the final loadsheet, the captain believed the reduced passenger figure reflected the number of people that had left the aircraft. Other than the passenger figure within the loadsheet, the flight crew were not advised of the final number of passengers that had disembarked the aircraft, nor was there a procedural requirement to do so.   

At 1712 the aircraft doors were closed. At 1714, the aircraft pushed back from gate 9 and it became airborne at about 1721. The captain recalled that during the take-off the aircraft was slightly slow to accelerate but they did not experience any controllability issues.

At 1737, when the aircraft was in cruise at 15,000 ft, the flight crew received an aircraft communications addressing and reporting system (ACARS)[7] message that load control were working to correct the loadsheet. On receipt of the ACARS message, the flight crew radioed the port controller and were advised that the loadsheet that had been issued to them contained an incorrect passenger figure. The flight crew placed the aircraft in a hold[8] while the correct weights were established. The aircraft later landed at Sydney Airport without further incident. 

Context

Departure control system

Qantas utilised the Amadeus Altéa Departure Control information technology system to manage operational activities. The system was composed of various integrated components including:

• Altéa Inventory (inventory) – which was used to manage flight schedules, passenger seating and flight disruptions.
• Altéa Customer Management (CM) – which was used to carry out the management of customers including monitoring cabin seating configurations, boarding activities, baggage, and acceptance figures.
• Altéa Flight Management (FM) – which was used to perform load control functions for aircraft and create the necessary documents for flight.

Customer journey management

Qantas customer journey personnel were responsible for the issuance of a new flight following a diversion to an alternate airport. These new flights, called ‘addstops’, were managed within the inventory system.

When issuing a new addstop flight, customer journey personnel would make manual amendments as required, including adding or changing the aircraft configuration code. If a change was made that resulted in the allocation of an aircraft with a smaller seating capacity than the original aircraft, it would cause the system to automatically either offload or place on standby the excess number of passengers. While the offloading of passengers was an automatic function, any further amendment to an aircraft with a larger capacity required the user to manually transfer the passengers back onto the flight.

Airport passenger management

Qantas airport personnel were responsible for the arrival and dispatch of the diversion flight, including oversight of the refuelling and passenger management. During this process, airport personnel utilised the CM system to manage passenger information. In normal circumstances, as passengers boarded a Qantas aircraft, their boarding passes were scanned, and the CM system was updated automatically with passenger boarding information. However, as this was a diversion flight which involved the majority of the passengers remaining on board, airport personnel were required to manually update this information within the CM system.

Loadsheet

General

A loadsheet is a document created for each flight that contains details such as the quantity and distribution of fuel, cargo, baggage, crew and passengers on board the aircraft. It is used to calculate aircraft weight and balance parameters, and performance requirements. Load control personnel were responsible for the creation of loadsheets using the FM system.

A provisional and a final loadsheet were required to be created for all flights. The provisional loadsheet detailed the anticipated configuration of the aircraft. The final loadsheet contained the confirmed aircraft configuration and could only be issued after the passenger and ramp clearances were received from the departure airport personnel.  

Ramp and passenger clearance

Ramp clearance was a report issued by the airport loading supervisor[9] to load control personnel indicating the completion of loading, including final baggage numbers. The data contained within the ramp clearance was then used for loadsheet computation.

Passenger clearance was a report issued by departure airport personnel to load control personnel indicating that no further passengers were to be accepted for the flight, with the majority of passengers on board and the remaining passengers’ exact location known.  

Communication of loadsheet errors

Load control loadsheet error communication procedures

In scenarios where an error was identified in the final loadsheet after it had been issued to the flight crew, but before the aircraft had departed from the gate, the Qantas Weight and Balance Manual required the load control operations leader (LOCO) to contact the movement control officer (MOCO) in Canberra and for them to notify the flight crew of the nature of the discrepancy.

Airport communication procedures

The procedures to be used by Qantas airport personnel to contact the flight crew prior to an aircraft having departed the gate were documented in the Qantas Canberra Airport Movement Control Operating & Training Manual (version 1.2 dated September 2024). That stated:

Contacting a [flight] crew is to be done via ground to air radio in the first instance.

If contact is not made, then an agent is sent to ask the crew to contact MOCO.

If agent is unable (due door closed/aerobridge disconnected), engineer/pushback on headset to request crew contact MOCO.

Flight crew communication procedures

The procedures to be used by flight crew when maintaining radio communications with the airport personnel were contained in the Qantas Flight Administration Manual (dated 1 August 2024) which stated:

Subject to operational requirements, flight crew should maintain a listening watch on company frequency and interphone during transit.

It also stated:

For domestic operations, the frequency for the [port controller] must be monitored from [estimated time of departure]-5 minutes until pushback commences. 

Loadsheet error and performance implications

Loadsheet information

The passenger composition and aircraft zero fuel weight (ZFW)[10] as documented in the loadsheet for the previous flight, and the erroneous and corrected loadsheet for the incident flight are contained in Table 1. 

Table 1: Loadsheet information

Loadsheet error

The erroneous loadsheet issued to the flight crew listed the total number of passengers on board the aircraft as 104, whereas the actual number of passengers on board was 155. This resulted in a ZFW of 55,539 kg when the actual ZFW of the aircraft was 59,830 kg.

The Qantas Flight Administration Manual contained a caution note to flight crew that stated:

Following a diversion the ZFW and passenger numbers on the loadsheet for the subsequent sector must be reconciled against those for the preceding sector. The new ZFW should be the same unless passengers disembark or pantry is changed.

For a change in passenger load allow 100 kg per passenger when reconciling ZFW values. e.g. if 20 pax disembark the new ZFW should be approximately 2,000 kg less than previous.

The error within the loadsheet resulted in a ZFW difference between the subsequent and preceding sectors of 5,725 kg, with 68 passengers captured as having disembarked the aircraft. This reduction in weight was more conservative than the formula contained within the Qantas Flight Administration Manual, which equated to about 6,800 kg. While the captain recalled being aware of the reduced passenger figure, they did not recount having undertaken the ZFW reconciliation calculation.

Performance implications

The flight crew used the incorrect loadsheet to calculate aircraft performance. This resulted in the generation of take-off speeds 3–4 kt less than those applicable to the aircraft’s actual weight. This increased the risk of degraded performance and unanticipated handling characteristics during the take-off. However, the flight crew elected to use the full length of the runway for the take-off, and did not apply the headwind component, which added an increased safety margin for take-off performance.

Independent passenger number verification

The Qantas Cabin Crew Operations Manual (dated 1 October 2024) contained a process for an independent verification of passengers on board an aircraft. It stated:

Security requires that where positive accountability of passengers is not possible during boarding, the number of passengers must be verified by a headcount prior to departure. The headcount is to ensure that the correct number of passengers have entered the aircraft, via the tarmac.

However, the process was not required for scenarios involving the partial disembarkation at a diversion airport.

Related occurrences

Aircraft loading and confirmation processes involve a number of people fulfilling different functions. Errors can be introduced at any point and carried through various interfaces.

At Sydney Airport in 2017, an Airbus A330 departed overweight after a required cargo variation was not actioned by ground crew (ATSB investigation AO-2018-003). A decision by the flight crew to carry additional fuel led to a requirement to reduce the weight of freight on board the aircraft. A 2,005 kg freight pallet was to be replaced with a lighter unit weighing 1,130 kg. The cargo variation was not actioned by the loading supervisor as electronic messages associated with the revised loading instruction were acknowledged without being correctly interpreted. That was probably influenced by the supervisor’s experience that load changes were accompanied by verbal advice, and that did not occur on this occasion.

In the East Midlands, UK, in 2023 a Boeing 737 tail strike resulted from the provision of 2 different load data sheets (AAIB investigation AAIB-29762). One was correct and the other, a remnant from the previous flight, was incorrect for the next flight. The incorrect data was used for performance calculations, and the aircraft weight was calculated to be around 10,000 kg lighter than the actual weight. This led to the take-off being 15 kt too slow on rotation and the tail struck the ground.

Five passenger loading events that occurred in Australia over the period 2015–2017 were investigated (ATSB investigation AI-2015-139). On these five separate occasions the aircraft were loaded with incorrect passenger distributions or with incorrect passenger numbers used to determine the aircraft's weight and balance. This placed increased operational pressure on flight and cabin crews and, on at least one occasion, adversely affected aircraft performance during take-off. 

Safety analysis

Incorrect aircraft configuration code 

The customer journey lead (CJL) entered the incorrect aircraft configuration code when creating the ‘addstop’ flight for the Canberra to Sydney sector. This error was consistent with a skill-based ‘slip’, where an individual’s intentions are correct, but the action is incorrectly completed (Tsang and Vidulich 2003). In this case, the CJL entered one incorrect digit. 

The CJL also described a high workload environment at the time due to the number of diverted flights, and that they felt a time pressure to complete the addstop task. According to Orlady and Orlady 1999, workload within the aviation environment can be considered as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’. Increases in workload during abnormal situations have been linked to an increase in error rates in individuals (Johannsen and Rouse 1983). Consequently, it is possible that the CJL’s input error was influenced by the increased workload they were experiencing at the time.

The CJL committed the flight in the Altéa Inventory system prior to identifying the error. When doing so, the CJL would have been presented with a pop-up that highlighted the business class seating issues. However, they did not specifically recount sighting or acknowledging the pop-up. This was probably due to ‘expectation bias’ which involves an individual observing what they expected to occur, rather than what actually occurred (Flight Safety Foundation 2014). It is therefore likely that the CJL acknowledged the pop‑up, without considering the contents of the message, due to their expectation that the flight information was correct.

Having later identified and corrected the aircraft configuration code, the CJL did not identify that the system had made automatic changes to the passenger composition of the flight. This was also likely due to expectation bias as the CJL believed the correction had fully addressed the issue. Consequently, some passengers who were on board the aircraft were offloaded, or listed as standby, and not reallocated to the flight.

Flight closed with incorrect passenger data

The Qantas airport duty manager (ADM) at Canberra closed the flight without identifying the 51 offloaded and standby passengers. As a result, these passengers were recorded as not being on board the aircraft. The ADM recalled that it was unusual for standby passengers to be listed for a diversion flight, and they did not see them within the Altéa Customer Management (CM) system. The ADM’s recollections were consistent with expectation bias, where the ADM’s prior experience with diversion flights influenced their ability to identify the unusual scenario.

Having closed the flight, the ADM was made aware of the standby passengers by a customer service agent. The ADM attempted to onboard these passengers within the CM system, but when this proved unsuccessful the ADM took no further action to address the issue. The ADM recalled assuming the standby passenger issue was a manifestation of the earlier problems with the addstop flight, and that load control were aware of the issue and would resolve it prior to publishing the loadsheet. As a result, they did not consider communicating the matter to load control.

Erroneous loadsheet issued

The load controller’s (LOCO) decision to issue the loadsheet to the flight crew, despite having ongoing concerns about the validity of the information, was likely influenced by several factors including the closure of the flight and issuance of the passenger clearance by the ADM. In accordance with Qantas procedures, the ADM’s passenger clearance confirmed to the LOCO that the number of people listed as on board the aircraft in the Altéa Flight Management (FM) system, was correct. However, as stated above, the ADM had later become aware that there were additional passengers listed as standby for the flight but did not communicate this information to the LOCO.

The LOCO had also exhausted their ability to identify the reason for the anomalies and resolve the issue, and they communicated their concerns to the load control system manager (LCSM). In response, the LCSM advised the LOCO to issue the loadsheet using the information within the FM system, which the LOCO then did. It is possible this outcome was a result of a phenomenon known as ‘risky shift’. Risky shift means it is easier for a group to make a decision involving a greater acceptance of risk than an individual would on their own due to a variety of factors including the diffusion of responsibility (Smith and Radinsky 1970).

The result was the provision of an erroneous loadsheet to the flight crew that contained a weight that was 4,291 kg less than the actual weight of the aircraft. Shortly after the loadsheet was issued to the flight crew, but before the aircraft had departed, the LCSM identified the standby passengers within the FM system and advised the LOCO.

Communication of loadsheet error

Once the LOCO was made aware of the error within the loadsheet, they took immediate action to inform the flight crew of the issue. When the captain did not answer their mobile telephone, the LOCO communicated the error to the airport movement control officer (MOCO) in accordance with Qantas procedures. Having done so, it was reasonable for the LOCO to believe the flight crew would be informed of the error and the aircraft would not be permitted to depart. 

On receipt of the information from the LOCO, the MOCO attempted to contact the flight crew via radio, but they had deselected the company frequency. This took place about 10 minutes prior to pushback at a time when Qantas procedures required the flight crew to maintain a listening watch on the company frequency, subject to operational requirements. The captain recalled that the radio was deselected to reduce distractions while they entered the loadsheet data and generated the take-off speeds. This reason for deselecting the company frequency was likely consistent with the ‘operational requirement’ caveat of the procedures. However, it limited the ability of Qantas airport personnel to communicate directly with the flight crew in the lead up to departure.

Having been unable to contact the flight crew via radio, the MOCO radioed the customer service agent (CSA 2) and instructed them to inform the flight crew that the loadsheet contained an error. This did not conform with Qantas procedures which required the flight crew to be instructed to contact the MOCO and communicate directly with them. Doing so would have ensured that the flight crew received the information and closed the communication loop with the MOCO.

The CSA 2 did not inform the flight crew. The CSA 2 reported that at the time the MOCO contacted them by radio the CSA 2 was with the customer service manager (CSM) at the aircraft door. The CSA 2 believed the CSM overheard the MOCO’s radio call and that the CSM would tell the flight crew. 

However, The CSM could not recall either being advised of a loadsheet error or overhearing the radio communications about the matter. It is likely that the CSM would have advised the flight crew had they heard of the problem. The flight crew were not informed of the loadsheet error.

While the procedure was for the MOCO to request direct communication from the flight crew, shortly after divesting responsibility to the CSA 2, the MOCO went on break as instructed by the ADM. No one was allocated the responsibility of ensuring resolution prior to departure as the MOCO believed the ADM was already aware of the loadsheet issue. However, the ADM reported they had no awareness of the error at that time. The MOCO did not return from break until after the aircraft had departed. 

The procedural and communication breakdown meant that while Qantas’ airport personnel were aware of problems with the loadsheet, no-one communicated directly with the flight crew or made certain that the flight crew understood that there was a problem. As a result, the aircraft departed with 4,291 kg more weight than anticipated by the flight crew. The flight crew’s prudence in applying safety margins to their departure profile avoided adverse outcomes for the flight. 

Independent process to confirm actual number of passengers on board aircraft

Qantas did not have an independent process to confirm the actual number of passengers on board an aircraft following partial disembarkation at a diversion airport. In these scenarios the final passenger figure within the loadsheet relied exclusively on the accuracy of the transposed data from the previous flight and any manual amendments made by Qantas airport personnel. Other than the figure within the loadsheet, Qantas had no other mechanism to advise the flight crew of the number of passengers that had disembarked the aircraft. Consequently, the absence of an independent process to confirm the actual number of passengers on the aircraft, such as a headcount, could limit a flight crew’s ability to verify the information contained within a final loadsheet and identify any passenger number error.

Findings

From the evidence available, the following findings are made with respect to the passenger loading event involving Boeing 737-838, VH-XZK, Canberra Airport, Australian Capital Territory, on 1 December 2024.

Contributing factors

• After correcting a minor data input error, the customer journey department did not notice that an automatic reduction in the number of passengers allocated to the flight had occurred. As a result, some passengers who were on board the aircraft were not reallocated to the flight.
• Although Qantas load control personnel held concerns about the validity of the data, and had attempted to understand it, the concerns were not resolved and the erroneous loadsheet was issued to the flight crew. The error was identified by load control after it had been provided to the flight crew, but before the aircraft had departed.
• Qantas airport personnel inadvertently used the erroneous passenger data within the scheduling information to close the flight. The issue was identified after the flight was closed, but the airport personnel did not ensure Qantas load control were aware of the matter.
• The flight crew were not informed of the identified loadsheet error before the aircraft departed. This was due to:
  • the flight crew had deselected the ground communication frequency and were therefore not contactable by radio
  • after instructing the customer service agent to contact the flight crew in person, there was no further follow-up or communication with the flight crew made by the movement controller
  • the customer service agent was not instructed to advise the flight crew to contact the movement controller via radio when attempting to pass the information on in person
  • the customer service agent understood that they had informed the cabin crew of the loadsheet error, and believed they would inform the flight crew.

Other factors that increased risk

• Qantas did not have an independent process to confirm the actual number of passengers on board an aircraft following partial disembarkation at a diversion airport. This could limit a flight crew’s ability to verify the information contained within a final loadsheet and identify any passenger number error.

Safety actions

Safety action by Qantas

The Qantas load control diversion checklist has been amended to include a requirement for airport personnel to conduct a headcount when a passenger discrepancy is identified. 

The Qantas airport product and service manual has been amended to contain a procedure for scenarios where critical flight information needs to be communicated to the flight crew, but they are uncontactable. This includes contacting air traffic control to prevent the aircraft from departing and requiring closed loop communications to confirm receipt of critical information. Qantas will also implement a procedure that allows load control personnel to contact flight crew directly via the aircraft communications addressing and reporting system when a loadsheet error is identified.

A local brief was issued to Canberra Airport personnel that defined the requirements for a handover, when going on break, to ensure critical information is communicated. A local brief was also issued that outlined the requirements for handling an inbound diversion, including ‘all possible scenarios regarding passengers disembarking/remaining onboard’. 

Sources and submissions

Sources of information

The sources of information used during the investigation included:

• Qantas
• captain and first officer
• customer service manager
• airport duty manager
• customer service agent
• officer movement control
• load control operations leader
• customer journey lead
• load control systems manager
• Bureau of Meteorology

References

Flight Safety Foundation. (2014). A practical guide for improving flight path monitoring, final report of the active pilot monitoring working group. Available from https://flightsafety.org.

Johannsen, G. and Rouse, W. (1983). Studies of planning behavior of aircraft pilots in normal, abnormal, and emergency situations. Systems, Man and Cybernetics, IEEE Transactions on, (3), pp.267-278.

Orlady, H. and Orlady, L. (1999). Human factors in multi-crew flight operations. Ashgate, Aldershot, UK p.203. 

Smith, G. and Radinsky, T. (1970). The Effect of Diffusion and Concentration of Responsibility on the Risky Shift Phenomenon in a Two-choice Situation. Proceedings of the Iowa Academy of Science, 77(1), 308-314.

Tsang, O. and Vidulich, M. (2003). Principles and practice of aviation psychology. Lawrence Erlbaum Associates, Mahwah, New Jersey.

Wickens, C. Hollands, J. Banbury, S. & Parasuraman, R. (2013). Engineering psychology and human performance (4th edition). Pearson, Boston.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Qantas
• captain and first officer
• customer service manager
• Canberra Airport duty manager
• Canberra Airport customer service agent
• Canberra Airport officer movement control
• load control operations leader
• customer journey lead
• load control systems manager
• Civil Aviation Safety Authority 

Submissions were received from:

• Qantas
• Civil Aviation Safety Authority
• load control operations leader
• Canberra Airport officer movement control.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.