Executive summary

What happened

On 19 November 2023, 2 SIAI Marchetti S-211s, operated by Jetworks Aviation and registered VH-DQJ (Viper 1) and VH-DZJ (Viper 2), departed Essendon Airport, Victoria on a formation flight to undertake in-flight filming of both aircraft over Port Phillip Bay, Victoria. 

During the flight, Viper 2 was manoeuvred to pass beneath an inverted Viper 1. As Viper 2 approached Viper 1, the vertical separation between the 2 aircraft reduced. Viper 2 then passed beneath and began to pitch up and bank left, away from Viper 1, with the right wings of each aircraft colliding. 

After the collision, and with the right wing significantly damaged, Viper 2 continued to climb and began rolling right, passing above and behind Viper 1. Viper 2 rolled to an inverted attitude and quickly assumed a near‑vertical, nose-down flight path and impacted the water at high speed. Both occupants were fatally injured. Viper 1 was not significantly damaged and returned to Essendon.

What the ATSB found

The ATSB found that prior to the accident manoeuvre, Viper 2 was manoeuvred to pass directly beneath Viper 1 for a filming opportunity. This specific manoeuvre had not been briefed before the flight and increased the risk of collision. A subsequent in-flight discussion of the manoeuvre did not allow for full consideration of associated risks before a second attempt was commenced. During the second attempt of the manoeuvre, the right wings of each aircraft collided. The damage sustained by Viper 2 resulted in an immediate loss of control, and soon after, the aircraft’s collision with water.

The ATSB also found that the pilot of Viper 1 had a medical restriction which required them to only operate an aircraft with a side-by-side cockpit configuration and a qualified safety pilot to be present. These requirements were not being followed during the accident flight. 

Furthermore, the operator did not hold the required operating certificate to undertake the filming flight and the aircraft were not permitted to be used for that purpose. This resulted in a lower level of safety assurance for the flights.

Safety message

The conduct of in-flight filming work introduces several risks to a flight including a potential increase in pilot workload and distraction. Additionally, efforts to maximise filming opportunities may conflict with the safe operation of the aircraft, in particular for aircraft operating in formation, which can further increase risk. Minimising the risk of these flights requires that the pilots prioritise operational safety, in particular through in-depth briefings, pre-flight planning of manoeuvres, and strict adherence to procedures and the agreed plan.

In addition, this investigation highlights the importance of adhering to operational restrictions to minimise risk. The pilot of Viper 1 had a medical restriction preventing them from operating the aircraft and regulatory restrictions were in place preventing the aircraft from being used for the filming. These limitations mitigated the known risks of the pilot's medical condition and the civil operation of ex-military aircraft. Operating outside of these limitations removed the in-built safety defences and organisational structures designed to identify and mitigate these risks.

Summary video

The investigation

The occurrence

On 19 November 2023, the crews of 2 SIAI Marchetti S-211s, operated by Jetworks Aviation and registered VH-DQJ and VH-DZJ, prepared to conduct a formation flight from Essendon Airport, Victoria. The flight operated using the callsign ‘Viper Formation’ and intended to undertake in-flight filming of both aircraft over Port Phillip Bay. VH-DQJ was the formation leader, operating as ‘Viper 1’, with a pilot and safety pilot (see the section titled Pilot details) on board. VH-DZJ was operating as ‘Viper 2’ with a pilot and camera operator on board.

Prior to commencing the flight, the crews conducted a brief of the planned manoeuvres. The first of the manoeuvres involved Viper 1 flying inverted, straight and level, while Viper 2, flying upright, moved to the right line abreast position for filming (panel C in Figure 1). From that position, Viper 2 would move as required for the filming while maintaining separation from Viper 1. The crews planned to conduct this manoeuvre with Viper 2 starting in the right echelon position (panel A in Figure 1) before moving rearward to allow Viper 1 sufficient room to roll inverted (panel B in Figure 1). After Viper 1 rolled inverted, Viper 2 was to move forward and climb or descend as needed to reach the line abreast position at the same altitude, for filming (panel C in Figure 1). During the manoeuvring, the pilots would communicate on a discrete radio frequency.

Figure 1: Planned manoeuvre sequence

Source: Kovozavody Prostejov, modified and annotated by the ATSB

The crews completed the brief and, at 1324 local time, the aircraft departed Essendon towards Port Phillip Bay. About 6 minutes later, while the aircraft were operating at about 3,000 ft above mean sea level and at a speed of about 200 kt, the crews began manoeuvring for the planned sequence. Viper 2 moved rearward (panel A in Figure 2) and Viper 1 rolled inverted (panel B in Figure 2). From a low right echelon position, Viper 2 then moved forward and climbed toward the line abreast position while also moving laterally closer to Viper 1 (panel C in Figure 2). The rate of closure between the aircraft increased and before Viper 2 could stabilise in the line abreast position, the pilot banked away and moved out of the formation (panel D in Figure 2). Viper 1 then rolled upright.

Figure 2: Recorded images from Viper 1 of first manoeuvre

Note: For ease of interpretation some images have been inverted to present all footage in an upright orientation.

Source: Recorded video from Viper 1, modified and annotated by the ATSB

Viper 2 rejoined the formation in the right echelon position (panel A in Figure 3) and shortly after, Viper 1 rolled inverted for a second attempt (panel B in Figure 3). On this occasion, instead of moving toward the line abreast and level position as planned, the pilot of Viper 2 manoeuvred to pass below (panel C in Figure 3) and across to the left of Viper 1 (panel D in Figure 3).

Figure 3: Recorded images from Viper 1 of second manoeuvre

Note: For ease of interpretation some images have been inverted to present all footage in an upright orientation.

Source: Recorded video from Viper 1, modified and annotated by the ATSB

The safety pilot in Viper 1 observed Viper 2 pass beneath and alerted the pilot of Viper 1 to the manoeuvre. The pilot of Viper 1 then rolled upright and contacted the pilot of Viper 2 to discuss the manoeuvre. The pilot of Viper 2 advised that passing underneath Viper 1 provided a good filming opportunity and requested to repeat the manoeuvre. After discussing the manoeuvre, the pilots decided to attempt it again, and Viper 2 moved to the right echelon position to recommence the manoeuvre.

As with the previous attempt, Viper 2 moved rearward to allow Viper 1 to roll inverted. Before Viper 1 stabilised in the inverted attitude (panel A in Figure 4), Viper 2 began manoeuvring to pass beneath Viper 1 (panel B in Figure 4) and the safety pilot noted that Viper 2 moved in and underneath ‘quite quickly’. Viper 1 then stabilised in the inverted attitude and as Viper 2 approached, the vertical separation between the 2 aircraft reduced. Viper 2 passed beneath and began to pitch up and bank left, away from Viper 1 (panel C in Figure 4). At 1333, as Viper 2 climbed and banked left, the right wings of each aircraft collided (panel D in Figure 4).

Figure 4: Recorded images from Viper 1 of third manoeuvre and collision

Note: For ease of interpretation the images have been inverted to present all footage in an upright orientation. The occupants of Viper 2 have been obscured in panel D.

Source: Recorded video from Viper 1, modified and annotated by the ATSB

After the collision, and with the right wing severely damaged (Figure 5), Viper 2 continued to climb and began rolling right, passing above and behind Viper 1. Viper 2 rolled to an inverted attitude and quickly assumed a near‑vertical, nose-down flight path toward the water and commenced a slow right roll until impacting the water at high speed. Both occupants were fatally injured.

Figure 5: Recorded image from Viper 1 showing the collision damage to Viper 2

Note: For ease of interpretation the image has been inverted to present an upright orientation.

Source: Recorded video from Viper 1, annotated by the ATSB

The pilot of Viper 1 felt the collision but did not observe it while the safety pilot observed Viper 2 pass underneath, climb and collide with Viper 1. The collision deflected Viper 1 right 35° from the level inverted attitude to an angle of left bank of about 145° from upright and slightly nose down. The pilot rolled the aircraft fully upright, checked the control response and assessed that the aircraft was controllable. The pilot then attempted to contact the pilot of Viper 2, but no response was received. 

The pilot of Viper 1 turned the aircraft back towards the location of the collision where the safety pilot observed a splash mark and debris from Viper 2 on the water’s surface. The pilot of Viper 1 contacted air traffic control (ATC) to advise of the mid-air collision and broadcast a ‘MAYDAY’.[1] Viper 1 then orbited the location of the splash mark to assist ATC in marking the location for search and rescue purposes (Figure 6).

Figure 6: Recorded flight path of Viper 1

Note: As is normal procedure for formation flights, only the formation leader (Viper 1) had the transponder active. Surveillance data was only recorded for that aircraft.

Source: Airservices Australia, Google Earth and ATSB

The pilot of Viper 1 then turned north‑east and conducted further controllability checks of the aircraft in both the cruise and landing configurations. 

The pilot considered diverting to the planned alternate airport of Moorabbin but assessed the aircraft to be fully controllable and not significantly damaged and elected to return along a coastal route to Essendon Airport (see the section titled Return to Essendon), landing at 1349.

Context

Aircraft details

The SIAI Marchetti S-211 (Figure 7) is a mid-wing aircraft designed for military flying training, with full dual controls and 2 tandem configured ejection seats fitted with 5-point restraint harnesses. The ejection seats were deactivated in VH-DQJ (Viper 1) and VH-DZJ (Viper 2). The aircraft were each powered by a Pratt and Whitney Canada JT15D-4C turbofan engine mounted in the rear fuselage. Fuel system limitations restricted inverted manoeuvres to periods not exceeding 30 seconds. 

Figure 7: VH-DQJ (left) and VH-DZJ (right)

Source: ATSB and Phil Vabre

VH-DQJ and VH-DZJ were built in Italy in 1985 and delivered to the Republic of Singapore Air Force (RSAF), where they operated in the military flight training role. From 1996, until 2009, the aircraft were based at Royal Australian Air Force Base Pearce, Western Australia, after which the S-211 fleet was retired from RSAF service. Following retirement from military service, several RSAF S-211s, including VH‑DQJ and VH-DZJ, were sold in Australia to civilian owners.

Under the Civil Aviation Safety Regulations (CASRs), pilots operating the S-211 were required to complete flight training and undertake flight reviews for the aircraft type.[2] Pilots were also required to hold a single engine aeroplane class rating and applicable design feature endorsements.

At the time of the accident, VH-DQJ had accumulated about 6,363 hours in service and had a maintenance release valid until 10 November 2024, or 6,458 hours in service. The aircraft was certified for day visual flight rules flight only. VH-DZJ had about 5,595 hours in service and had a maintenance release valid until 28 July 2024 or 5,678 hours in service. The aircraft was certified for instrument flight rules operations.

Limited category operations

Ex-military aircraft or ‘Warbirds’, can be operated in Australia under a Limited category Certificate of Airworthiness (CoA) and in accordance with CASR Part 132. These operations were administered by the Australian Warbirds Association Limited. The Limited airworthiness category differs from the Standard category or other categories and includes restrictions on where and how these aircraft can be flown.

In 2011, VH-DQJ and VH-DZJ were entered onto the Australian Civil Aircraft Register and issued with special CoAs in the Limited category. The special CoA was subject to several conditions, including limitations on the permitted uses of the aircraft. For both aircraft, the permitted uses were:

• adventure style operations
• exhibition
• aerobatics
• mock combat.

The Civil Aviation Safety Authority (CASA) advised that the flights constituted an aerial work operation (see the section titled Operator details). Limited category aircraft were not permitted to be used for aerial work operations. 

The carriage of passengers in these aircraft was permitted provided the person operating the aircraft ensured that each passenger was made aware that:

• the design, manufacture, and airworthiness of the aircraft were not required to meet any standard recognised by CASA
• the aircraft was not required by CASA to be operated to the level of safety normally associated with a commercial passenger flight
• that persons fly in the aircraft at their own risk. 

Where paying passengers were carried for experience flights in ex-military aircraft (subject to a Limited category CoA), the passenger was required to read and acknowledge the following warning prior to payment for the flight being made:

Warning

When you fly in this aircraft, you do so at your own risk.

Any safety equipment provided by the operator of this aircraft must be worn at all times. The operator will provide you with information regarding its purpose and directions for its use.

The design, manufacture and airworthiness of the aircraft are not required to meet any safety standard recognised by CASA.

The aircraft is not required by CASA to be operated to the same safety standards as an aircraft used for regular public transport or charter operations.

Similar information was also included on a placard on the rear (passenger’s) instrument panel (Figure 8).

Figure 8: Rear instrument panel placard in Viper 1

Source: ATSB

Pilot details

The ATSB found no indicators that any of the flight crewmembers were experiencing a level of fatigue known to affect performance.

The crew of both aircraft were not wearing parachutes[3] or life jackets. 

Viper 1 (VH-DQJ) pilot

The pilot of Viper 1 held an Air Transport Pilot Licence (Aeroplane) along with the required ratings, endorsements, and type training to operate the S-211 as pilot in command. In addition, the pilot held flight activity ratings and instructor training approvals for formation flying, formation aerobatics, low-level aerobatics (minimum height of 500 ft above ground level) and spinning. The pilot also held several type ratings in transport category turbine engine aircraft.

The pilot had recorded over 20,700 hours of flying time before the accident flight of which 10.8 hours were in the S-211. The pilot’s flying experience included military service operating aircraft of similar performance and handling to the S-211 and formation aerobatics displays. The pilot also had significant experience in civil formation aerobatic displays.

The pilot held a Class 2 aviation medical certificate valid until 21 August 2024 with a restriction that required them to fly with a safety pilot.

Safety pilot medical restriction

The safety pilot restriction was applied to the pilot’s medical certificate as the pilot was assessed to be at an elevated risk of distraction or incapacitation (subtle, partial, or full) resulting from a medical episode. This restriction provided a risk mitigation, where a suitable safety pilot could quickly take over control of the aircraft, in the event medical symptoms occurred in flight. 

The restriction required that any aircraft flown by the pilot be configured with side-by-side seating in the cockpit and have a full set of dual flying controls. This requirement facilitated better communication between the pilot and safety pilot and allowed the safety pilot to directly observe the pilot to identify incapacitation symptoms. It also allowed the safety pilot to physically move the pilot should an incapacitation result in interference with the aircraft controls.

The restriction also required that the safety pilot:

• be endorsed and current on the aircraft type being flown
• be appropriately rated for the in-flight conditions
• have a medical certificate not restricted to multi-crew flight operations
• be aware of the type of incapacity the pilot may suffer in flight
• be prepared to take over the aircraft controls during critical phases of flight
• be competent and capable of concluding the flight safely from the control seat.

The pilot was also required to ensure that the safety pilot had read the requirements associated with the restriction.

The pilot of Viper 1 was aware of the medical restriction but had not read all the documentation detailing the specific requirements associated with the medical certificate restriction. Although they were not aware of the specific requirements for selecting a safety pilot, the pilot applied an informal assessment that satisfied them that the selected safety pilot was suitable to act in the role.

Viper 1 (VH-DQJ) safety pilot

The safety pilot in Viper 1 held an Air Transport Pilot Licence (Aeroplane) along with the required ratings and endorsements to operate the S-211. The safety pilot had commenced but had not yet completed the required training in the aircraft type to be qualified to operate the aircraft as pilot‑in‑command.

The safety pilot also held flight activity endorsements for formation flying, formation aerobatics, and spinning, as well as type ratings in several transport category turbine engine aircraft.

The safety pilot had recorded a total of 12,276 hours before the accident flight, including a previous training flight of 1 hour in the S-211. The safety pilot’s experience also included military service operating aircraft of similar performance and handling to the S-211 and formation aerobatic displays.

The safety pilot held a Class 1 aviation medical certificate valid until 22 February 2024 and was not restricted to multi-crew flight operations.

The safety pilot was aware of the pilot’s medical restriction and requirement for a safety pilot but was not aware of the specific requirements associated with the restriction, including the requirement to be endorsed and current on the aircraft type. To fulfil their role, the safety pilot carried S-211 checklists and operational documentation sufficient for the flight. With the exception of completing training in the aircraft type, the safety pilot held all other required qualifications for the aircraft and flight activities planned for the flight and felt well prepared to fulfil the role and take control should the pilot become incapacitated.

Viper 2 (VH-DZJ) pilot

The pilot of Viper 2 held a Commercial Pilot Licence (Aeroplane) along with the required ratings, endorsements, and type training to operate the S-211 as pilot in command. In addition, the pilot held formation flying, formation aerobatics, low-level aerobatics (minimum height of 500 ft above ground level) and spinning flight activity endorsements.

The pilot had recorded a total of 1,542 hours before the accident flight, including 489 hours on the S-211 aircraft type. 

The pilot held a Class 1 aviation medical certificate valid until 28 February 2024. 

Operator details

The aircraft were operated by Jetworks Aviation and the purpose of the accident flight was to produce footage to promote a proposed television program using the aircraft. The television program was envisaged by the pilot of Viper 2, who owned Jetworks Aviation and both S-211s as well as a Pacific Aerospace CT/4E that was also to be used for the program. The pilot of Viper 2 had also coordinated the filming activity with the production company.

CASA advised that the filming of a formation flight, with a dedicated camera operator for the purposes of producing footage for a television program involving those aircraft, constituted a task specialist operation.[4] This operation type was defined as an aerial work operation by CASR 138.010. To undertake such an operation, the operator required an aerial work certificate in accordance with CASR 138.030.

The operator did not hold an aerial work certificate and Limited category aircraft were not permitted to be used for aerial work operations.

Approved aerial work operations required several organisational risk mitigations not found in Limited category operations under CASR Part 132, including:

• aerial work aircraft were required to hold a Standard CoA, meeting airworthiness standards for at least one of the following categories:
  • Transport, Commuter, Normal, Restricted and Utility
• aerial work passengers could only be carried in Transport, Commuter and normal category aircraft
• a requirement for identified key personnel with defined experience requirements and responsibilities
• an approved operations manual for all proposed operations, including risk assessment requirements and for non-propeller turbine aircraft, a safety management system[5]
• prescribed training and checking requirements.

Following the accident, the operator ceased operations.

Recorded data

Neither aircraft was fitted with a flight data recorder or cockpit voice recorder, nor were they required for the type of aircraft and operation.

The camera operator in Viper 2 carried a hand-held camera for filming and several video cameras were also mounted within the cockpit of both aircraft. None of these were able to be located during recovery operations or in the recovered wreckage.

There were 4 cameras fitted to Viper 1, of which 3 recorded video and audio during the flight (Figure 9), including the collision. The cameras were mounted on each side of the front seat headrest, looking left and right, on the glareshield looking forward and one mounted on the instrument panel facing the control column. The camera facing the control column stopped recording before departure while the cameras facing forward and left stopped filming during the return flight to Essendon. The right facing camera stopped filming after the flight as the crew exited the aircraft.

Figure 9: The recorded views of the cameras fitted to Viper 1

Source: Recorded video from Viper 1, annotated by the ATSB

The elapsed time between Viper 2 passing directly beneath Viper 1 and the collision occurring was about 2 seconds. The recorded footage showed that during this time, and just prior to the collision, the pilot of Viper 2 was looking up toward Viper 1. 

Airflow and engine noise dominated the audio recorded by the cameras. ATSB analysis of the recorded audio, including using voice enhancement programs, was unable to recover intelligible voices from the audio data.

Recorded surveillance and communications audio data was provided by Airservices Australia. The discrete radio frequency used by the crews during the manoeuvres was not recorded.

Formation flying

Formation flying is when more than one aircraft, by prior arrangement between the pilots, operate in close proximity and as a single aircraft with regard to navigation, position reporting and air traffic control management. In Australia, to undertake formation flying, a pilot must have completed formation flying training and hold a formation flying flight activity endorsement.

The Formation and Standards Team Australia (FASTA)[6] Formation Fundamentals manual provided guidance on formation flying. That manual stated:

Within the formation, each pilot has a defined position and responsibilities. In a formation of 2 aircraft, these positions are defined as the lead and wingman. The lead pilot’s responsibilities include:

• briefing the flight

• safely conducting the flight

• manoeuvring smoothly and predictably.

The wingman’s responsibilities include:

• maintaining formation integrity

• always keeping the lead aircraft in sight

• maintaining separation from the lead aircraft.

When moving between formation positions, a wingman should always use small flight path changes to ensure that the closure rate between the aircraft remains manageable. When changing formation position, the wingman should also be focused on looking toward the intended direction of flight while maintaining awareness of the lead’s position and not focus on looking toward the lead aircraft. Looking toward the lead aircraft may result in the wingman inadvertently applying control inputs in the direction they are looking (‘hands following head’) and inadvertently manoeuvring their aircraft toward the lead aircraft.

Briefings

Pre-briefing of in-flight manoeuvres is critical to safe formation flying. Conducting this briefing on the ground prior to flight provides opportunity for all crewmembers to focus on the briefing, make a full assessment of considerations and risks associated with the planned manoeuvres, and ensure that everyone has similar understanding of the intended manoeuvres.

Pre-briefing of a manoeuvre can also be conducted in-flight. When compared to a face‑to‑face pre-flight briefing, an in-flight briefing, using radio and while also flying the aircraft, limits a pilot’s ability to articulate and understand intended manoeuvres and fully consider associated risks. In‑flight briefings can also reduce the lead’s ability to assess that there is mutual understanding before approving a manoeuvre.

The accident flight was the second filming flight of the day involving the 2 aircraft and pilots. A pre‑flight briefing had been completed prior to the first flight, but during that flight, the camera equipment stopped working before all planned manoeuvres were completed. Therefore, after landing, a second flight was planned, and another full pre-flight briefing conducted, addressing the manoeuvres that were not completed during the first flight.

During this additional pre-flight briefing, the crews briefed several manoeuvres, the first of which involved Viper 2 moving into a line abreast position to the right of an inverted Viper 1 for filming. The pilots of the 2 aircraft agreed that while Viper 1 was inverted, Viper 2 had freedom to manoeuvre as desired for filming with a restriction to remain behind the 9 o’clock to 3 o’clock line (an imaginary line running laterally through the wingtips of Viper 1).

During the second filming flight, Viper 2 passed beneath and to the left of Viper 1 without first advising the crew of Viper 1. Subsequently, the pilots of each aircraft conducted an in‑flight briefing of the manoeuvre and decided to attempt it again. The pilot of Viper 1 understood that the second attempt at the manoeuvre would be flown like an aborted formation rejoin (overshoot), but with Viper 2 passing directly beneath. 

In this scenario, when an approaching wingman assesses that their manoeuvring to rejoin the formation is unstable or unsafe and wishes to abort the rejoin, an overshoot is conducted. In an overshoot from the right echelon position, the wingman’s aircraft is manoeuvred below and behind the lead aircraft, passing across to the other side of the formation before positioning to attempt another rejoin. To minimise the risk of collision during this manoeuvre, the wingman must ensure that no part of their aircraft passes directly beneath the lead aircraft. 

Meteorology

The flights and filming manoeuvres were conducted in clear and smooth flying conditions. 

At 1330, 3 minutes before the collision, the Bureau of Meteorology (BoM) weather station at South Channel Island, 12 km south‑west of the collision location, recorded the surface wind as southerly at 11 kt.

At the same time, the BoM weather station at Avalon Airport recorded the surface wind as easterly at 9 kt, no cloud and the visibility as greater than 10 km.

Collision damage and wreckage examination

At the time of the collision, Viper 2 was pitched slightly nose up, in a left bank, rolling left and had slightly higher speed than Viper 1. The first contact during the collision occurred when the forward right wingtip of Viper 2 impacted the right wing of Viper 1. The impact to the wing of Viper 1 was distributed across both the front and rear spars and 2 main outboard wing ribs.The impact to the wing of Viper 2 occurred in the relatively weaker area of the front spar and 2 of the outermost wing ribs (Figure 10). 

Figure 10: Cutaway drawing of the S-211 right wing structures in the primary impact areas

Source: Leonardo S.p.A., modified and annotated by the ATSB

Viper 1 (VH-DQJ)

Following the accident, Viper 1 was examined by the ATSB at Essendon Airport. Impact marks, including marks consistent with the wingtip fairing screws and wingtip light housing from Viper 2, along with paint transfers, were visible on the upper surface of the right wing. The upper wing skin was deformed, and the landing light cover broken (Figure 11).

Figure 11: Viper 1 collision damage

Source: ATSB

Viper 2 (VH-DZJ)

Witnesses observed Viper 2 impact the water in a near-vertical, nose‑down attitude at high speed. The aircraft was extensively damaged and came to rest on the floor of Port Phillip Bay at a depth of 24 m. 

The wreckage was located the day after the accident and, on 25 November, Victoria Police recovered most of the fuselage, including the engine. The wing structures and most of the empennage were unable to be located and were not recovered. In the following days, the police conducted further diving operations to retrieve other aircraft debris and associated items.

The ATSB examination of the recovered wreckage did not identify any pre-impact faults, although the scope of the examination was limited by the extensive damage to the aircraft. Damage to the engine was consistent with the engine operating at the time of the collision with water. Examination of the recorded imagery indicated that there were no pre‑collision faults with either aircraft.

The recorded video showed that upon impact, the outboard section of the right wing of Viper 2 bent downward and the lower wing skin separated from the wingtip toward the wing fence[7] along a rivet line immediately aft of the leading edge (Figure 12). The wing tip, leading edge skin and forward wing spar were all deformed by the impact. Once the wing structure of Viper 2 started to fail, it redistributed the load across the wing of Viper 1, lessening the local effects and reducing the overall loads to that aircraft. The right aileron of Viper 2 was also deflected downward in both the normal plane of movement and also the spanwise direction, likely due to the outboard wing section and rear wing spar also being deformed downward. 

Figure 12: Right wing of Viper 2 immediately after the collision

Note: For ease of interpretation the image has been inverted to present the footage in an upright orientation.

Source: Recorded video from Viper 1, modified and annotated by the ATSB

Return to Essendon Airport

Following the collision, Viper 1’s return to Essendon passed over built-up areas. The ATSB examined whether a diversion to another airport would have significantly reduced the risk to persons on the ground from falling debris or a loss of control.

Several airports were available to the crew of Viper 1 for landing. Of these, Avalon Airport presented the most suitable alternative as it was equipped with fire and rescue facilities, a suitable runway, was located away from built up areas and weather conditions at the time were suitable for its use. 

Avalon was located 23 NM north‑west of the position of the collision, less than the 39 NM return flight flown by the crew to Essendon, but a direct flight to Avalon would have required flight over water beyond the gliding capability of the aircraft, exposing the crew to elevated risk in the event of a ditching. Following the coast to Avalon (as the crew of Viper 1 did during the return to Essendon) required a 52 NM (northern route) or a 38 NM (southern route) flight (Figure 13).

Figure 13: Flight paths to Avalon Airport

Source: Airservices Australia, Google Earth and ATSB

Following the collision, the crew of Viper 1 conducted controllability checks in both the cruise and landing aircraft configurations. These checks satisfied the crew that the aircraft was not significantly damaged, was fully controllable and that there were no indications that components would detach from the aircraft.

The crew had pre-briefed Moorabbin (also surrounded by built up areas) as the diversion airport but were not prepared for a diversion to Avalon. Therefore, when compared with the return to Essendon that the crew were prepared for and had already undertaken earlier that day, a diversion to Avalon would have introduced additional operational complexities that would have further increased the crew’s workload.

The ATSB assessed that, while a diversion to Avalon would have presented a lower risk to people on the ground than the crew’s decision to return to Essendon, it did not unduly increase risk and was reasonable given the information and resources available to the crew at the time.

Similar occurrences

Argentine Junta de Investigacion de Accidentes de Aviacion Civil investigation 88/15 (LQ‑CGK and LQ-FJQ)

On 9 March 2015, 2 Eurocopter AS350-B3s registered LQ-CGK and LQ-FJQ were operating an aerial filming flight for a French television programme near Villa Castelli, Rioja, Argentina. During the filming flight, the helicopters collided with each other and subsequently with terrain. The pilot and 4 passengers on board each helicopter were fatally injured.

United States National Transportation Safety Board investigation WPR14FA174 (N4962U and N20SF)

On 27 April 2014, a Cessna 210E registered N4962U and Hawker Sea Fury registered N20SF were being flown from Half Moon Bay Airport, California, United Sates of America, to Eagle’s Nest Airport. During the flight, the faster Sea Fury approached the Cessna from behind and the pilot contacted the pilot of the Cessna advising that they intended to pass below and to the left of the Cessna. The Cessna pilot acknowledged and advised that they wanted to take a photograph, the Sea Fury pilot replied that there would probably not be time due to the speed differential. The Sea Fury pilot then observed the Cessna abruptly roll left and attempted to avoid collision by pitching their aircraft’s nose down. The 2 aircraft collided, and the Cessna then collided with terrain fatally injuring the pilot. The Sea Fury landed safely. 

United States National Transportation Safety Board investigation CHI06FA077A (N3735W and N372AC)

On 5 February 2006, 2 Shorts Brothers SD360-300 aircraft registered N3735W and N372AC were operating on a formation flight to undertake filming of each aircraft. While flying in formation, the pilot of N3735W advised the pilot of N372AC via radio that they would turn right, toward N372AC while descending. During the turn, the left wing of N3735W collided with the left wing and engine of N372AC. After the collision, N3735W collided with terrain fatally injuring the flight crew and passenger. N372AC made an emergency landing at a nearby airport. The occupants of that aircraft were not injured.

Safety analysis

Accident manoeuvre

Before the flight, the crews briefed and prepared for a manoeuvre that involved Viper 2 moving up to the line abreast position to the right of an inverted Viper 1. It had also been agreed that Viper 2 had some flexibility to move as desired to maximise filming opportunities, while also being responsible for maintaining separation between the 2 aircraft. The pilot of Viper 2 subsequently performed a manoeuvre to pass underneath Viper 1 without pre-briefing the manoeuvre and without advising the crew of Viper 1. During this manoeuvre, Viper 2 passed directly underneath Viper 1 at a close distance, increasing the risk of collision. This manoeuvre had not been specifically briefed prior to the flight and therefore a full assessment of the associated risks was not made at that time. 

Following this manoeuvre, there was an in-flight discussion between the pilots. The pilot of Viper 2 advised that the manoeuvre provided a good filming opportunity and asked to repeat it. The pilots discussed the manoeuvre before agreeing to a second attempt. However, the in-flight discussion using the radio, while also flying the aircraft, likely limited the ability of the pilots to ensure there was a full consideration of the associated collision risks and that all participants had a similar mental model.

The recorded video showed that during the accident manoeuvre, Viper 1 maintained stable and level inverted flight. As Viper 2 passed underneath, that aircraft began to climb toward Viper 1 and continued to climb as it passed across to the left side of Viper 1. During this period (about 2 seconds), the pilot of Viper 2 was looking at Viper 1. Just before the collision, the pilot of Viper 2 banked the aircraft away from Viper 1 and the wings collided. It is possible that as Viper 2 passed beneath Viper 1, the pilot inadvertently applied control inputs moving the aircraft closer to Viper 1 (hands following head), but there was insufficient evidence to confirm whether that occurred. 

The safety pilot observed Viper 2 pass underneath and begin climbing toward Viper 1, but the collision occurred before the safety pilot could recognise the collision risk and take any avoiding action.

The impact loading on Viper 1 occurred further in-board on the wing, to relatively stiffer and heavier structures, and with impact loads distributed more evenly across the front and rear spar (the primary load carrying structure). In addition, once the structure on Viper 2 started to fail, it redistributed the load over the wing of Viper 1, lessening the local impact effects. As a result, Viper 1 was not significantly damaged and landed safely at Essendon.

Conversely, the primary impact loading on Viper 2 was further outboard near the wingtip to relatively weaker structure, with the loads primarily absorbed by the front spar, resulting in failure of the spar and substantial deformation to the outboard wing section.

The damage to Viper 2 was substantial, created a significant amount of drag, and reduced both lift and aircraft controllability. The video showed that immediately after the impact, control of Viper 2 was lost and soon after, it collided with water, fatally injuring the pilot and camera operator. 

Medical restrictions not followed

The pilot of Viper 1 was subject to a medical restriction which prevented them from operating an aircraft with the tandem cockpit configuration of the S-211. However, when the pilot received their medical certificate, they did not fully read the associated requirements and were not aware of that restriction. 

This restriction was applied to reduce the risk of any distraction or incapacitation (subtle, partial, or full) to the pilot resulting from a medical episode. By not following this restriction and operating a tandem configured aircraft, the pilot reduced the ability of the safety pilot to identify any early indications of incapacitation and to manage them if they progressed. Given the precise nature of the manoeuvres required in the flight, even a subtle distraction or partial incapacitation could have significantly increased risk to both aircraft. Furthermore, if the pilot were to become fully incapacitated, the safety pilot would not have been able to reposition the pilot if the controls were obstructed or to take control of the aircraft in a timely manner. 

The recorded video showed that the during the filming manoeuvring, Viper 1 was manoeuvred as intended with no indication of any pilot incapacitation. Therefore, while this aspect of the medical restriction not being followed increased risk to the flight, it did not contribute to the accident. Furthermore, the risk of control obstruction was reduced by the comprehensive pilot restraints fitted to the S-211. 

Having not fully read the medical restriction requirements, the pilot of Viper 1 was also not aware that the safety pilot needed to be fully qualified on the aircraft type to act in that role or that the safety pilot was also required to read the medical restriction requirements. As a result, the safety pilot was not made aware of these requirements. 

The safety pilot had not completed the required training to operate the S-211, and therefore was not qualified to act in the safety pilot role. While an unqualified pilot operating an aircraft that they are unfamiliar with can significantly increase risk to a flight, in this case, the safety pilot had commenced S-211 training and was familiar with the aircraft. Furthermore, the safety pilot had significant experience in similar aircraft and operations and carried all required checklists and documentation to operate the S-211 for the flight. Therefore, while the safety pilot was not qualified to meet the requirements of the role, they were prepared and capable of taking control of the aircraft should they have been required to do so. For those reasons, the ATSB assessed that risk to the accident flight was not unduly increased by this mitigation not being followed completely.

Operation type

Ex-military aircraft operated in the Limited airworthiness category are not required to meet civilian airworthiness standards and are operated in Australia with a special certificate of airworthiness. These aircraft can be operated under Civil Aviation Safety Regulation (CASR) Part 132. The framework of these regulations acknowledges the higher risk associated with the operation of these aircraft and mitigates this risk, in part, through limitations on their use. 

The purpose of the accident flight was to produce footage of the aircraft to promote a proposed television program. However, the limitations placed on the operation of Limited category aircraft did not permit them to be used for that purpose.

The filming flights were required to be conducted as an aerial work (task specialist) operation. Aerial work operations under CASR Part 138 include several organisational and operational risk mitigations intended to increase safety assuredness that are not required under CASR Part 132. Operating outside of this established framework removed the built-in safety defences of the regulatory structure, thereby increasing operational risk. However, while the reduced airworthiness requirements of Limited category aircraft increased operational risk more generally, these did not contribute to the aircraft handling or decision-making that led to the collision and subsequent loss of Viper 2. Furthermore, it could not be determined if the application of the aerial work regulatory structure to the flights would have introduced a risk control that may have prevented the accident. Therefore, while overall risk assuredness was reduced by the unpermitted operation, using the aircraft in this way could not be shown to have contributed to the accident.

Findings

From the evidence available, the following findings are made with respect to the mid-air collision involving SIAI Marchetti S-211s, VH-DZJ and VH-DQJ, 25 km west of Tyabb Airport, Victoria on 19 November 2023.

Contributing factors

• During a formation flight for the purpose of in-­flight filming, Viper 2 was manoeuvred directly beneath Viper 1 for a filming opportunity. This manoeuvre had not been briefed before the flight and increased the risk of collision. An in-flight discussion of the manoeuvre did not allow full consideration of the associated risks before a second attempt was commenced.
• During the second attempt of the manoeuvre, Viper 2 passed beneath, and climbed toward, an inverted Viper 1 and the right wings of each aircraft collided.
• The damage sustained by Viper 2 during the collision led to an immediate loss of control and soon after, a collision with water. Viper 1 was not significantly damaged, and that aircraft landed safely.

Other factors that increased risk

• The pilot of Viper 1 had a medical restriction which required them to only operate an aircraft with a side-by-side cockpit configuration and a qualified safety pilot to be present. These requirements were not being followed during the accident flight.
• The operator did not hold the required operating certificate to undertake the filming flight and the aircraft were not permitted to be used for that purpose. This resulted in a lower level of safety assurance for the flights.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and safety pilot in VH-DQJ
• Civil Aviation Safety Authority
• Australian Warbirds Association Limited
• Victoria Police
• the aircraft manufacturer
• the maintenance organisation for VH-DZJ and VH-DQJ
• Airservices Australia
• accident witnesses
• video footage of the accident flight
• a formation flying subject matter expert
• Argentine Junta de Investigacion de Accidentes de Aviacion Civil
• United States National Transportation Safety Board.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• pilot and safety pilot in VH-DQJ
• the next of kin of the pilot and camera operator of VH-DZJ
• Civil Aviation Safety Authority
• Australian Warbirds Association Limited
• a formation flying subject matter expert
• aircraft manufacturer
• engine manufacturer.

Submissions were received from:

• pilot and safety pilot in VH-DQJ
• the next of kin of the pilot and camera operator in VH-DZJ
• Civil Aviation Safety Authority
• Australian Warbirds Association Limited.
• the formation flying subject matter expert

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 12 November 2023, a pilot was conducting a private, return trip in a Stoddard Hamilton Aircraft Glastar, registered VH-BAQ, from Greenfields private airstrip at Boreen Point, Queensland, with one passenger on board. During the final approach, the aircraft reportedly landed firmly and encountered a left crosswind that resulted in the pilot initiating a go-around.

Shortly after, the aircraft struck a palm tree and collided with terrain. The aircraft was substantially damaged, the pilot sustained minor injuries while the passenger was seriously injured.

What the ATSB found

The ATSB found that on touchdown the aircraft reportedly encountered a left crosswind gust that turned the aircraft towards obstacles to the south of the runway. During the subsequent go‑around, the aircraft was not realigned with the runway and the best angle of climb airspeed was not achieved, resulting in a collision with terrain.

Safety message

Pilots should be prepared to conduct a missed approach/baulked landing during every approach and be aware of the factors that can significantly affect subsequent climb performance. This prevents the likelihood of experiencing slow reaction times associated with surprise/startle events and ensures a safe go-around. 

The investigation

The occurrence

On 12 November 2023, a pilot and passenger were conducting a private, return flight in a Stoddard Hamilton Aircraft Glastar, registered VH-BAQ, from Greenfields private airstrip near Boreen Point, Queensland.

The aircraft departed at approximately 0730 local time and tracked north over Gympie, then flew to Maryborough where the pilot conducted a practice forced landing. They then followed the coastline from Rainbow Beach to the township of Teewah, before tracking west back towards the Greenfields airstrip. 

At 0901, the aircraft joined the circuit for runway 10[1] via a descending downwind leg. The pilot reported that the wind was a slight left crosswind of about 5–7 kt. The pilot recalled that they selected one stage of flap for the approach and when they turned final, they slowed the aircraft to about 65 kt indicated airspeed (IAS).

They advised that as they crossed a tree line in the runway undershoot (Figure 1) the aircraft encountered sink and in response, they twice increased the engine power. The pilot reported that, despite the increased engine power, the aircraft touched down firmly and simultaneously the aircraft was struck by a gust of crosswind, which picked up the left wing and turned the aircraft to the right towards the house.  

In response, the pilot applied full power to go-around. The aircraft became airborne, cleared a property fence, a building and then struck the top of a palm tree and subsequently collided with terrain. The aircraft was substantially damaged, the pilot sustained minor injuries and the passenger was seriously injured.

Figure 1: Approach to Greenfields airstrip

Altitude is shown in ft above mean sea level and the groundspeed is recorded in kt.

Source: Google Earth with data from OzRunways annotated by the ATSB.

Context

Pilot experience

The pilot obtained a recreational pilot licence in November 2020 and at the time of the accident had accumulated 148.4 hours of aeronautical experience, with 22 of those hours in the accident aircraft. The pilot had flown 4.6 hours in the last 90 days, all of which were on the accident aircraft and included the 1.5 hours flown on the day of the accident.

Aircraft

The accident aircraft was a Stoddard Hamilton Aircraft Glastar GS-1 (serial no. V373X) amateur‑built aircraft, which was registered for the first time in February 2001. It had a Subaru piston engine and the aircraft’s annual inspection had been conducted approximately 6 weeks prior to the accident. 

Weather

Meteorological data recorded at the closest airport – Sunshine Coast (about 36 km to the south‑east) was provided by the Bureau of Meteorology. The 0900 METAR/SPECI report indicated that there was a light wind of approximately 7 kt from 110˚ at the Sunshine Coast Airport around the time of the accident. 

Flight data

Flight data obtained from OzRunways, recorded the time, aircraft location, altitude and groundspeed several times per minute. 

This data identified that the aircraft joined downwind at approximately 853 ft above sea level[2] while descending at 108 kt groundspeed[3] (Figure 1). The aircraft subsequently turned base at 427 ft and slowed to 71 kt. The groundspeed when the aircraft turned final was approximately 62 kt and during approach, the speed continued to reduce. The speed as the aircraft crossed the tree line was approximately 55 kt, with the aircraft crossing the threshold at 49 kt.

During the go-around, the speed reduced from approximately 50 kt to between 40–44 kt until the aircraft struck the tree (Figure 2).

The ATSB was unable to verify the windspeed and direction at Greenfield airstrip. However, the windspeed at Sunshine Coast Airport was consistent with the pilot’s report of 5–7 kt, although there was about a 90° difference in wind direction between that recorded at the Sunshine Coast and the direction reported at Greenfield by the pilot. 

Figure 2: Missed approach and track divergence

Source: Google Earth with data from OzRunways, annotated by the ATSB

Approach procedure

The pilot operating handbook (POH) for the aircraft recommended a normal approach speed of 65 kt IAS slowing to 60 kt over the threshold. It also advised that the aircraft can be ‘landed with no flaps, half flaps or full flaps but the recommended speeds remained the same’. The POH also noted that ‘at slower airspeeds, the power-off sink rate increases rapidly’.

The published stall speed for the aircraft varied between 43–49 kt IAS, depending on whether flaps were retracted or fully deployed.

Go-around procedure 

The go-around procedure from the POH required the addition of full power and a speed of 65 kt IAS to ‘achieve the best angle of climb when clearing obstacles’. 

Decision making 

The Federal Aviation Administration’s (FAA) publication The art of aeronautical decision-making advised that aviation decision making can be broken down into 3 parts - perceive, process and perform. In addition, the FAA publication Airplane flying handbook Chapter 18 Emergency procedures advised that a pilot takes about 4 seconds to perceive and react to an emergency situation.

Accident site

The ATSB did not attend the accident site and therefore did not conduct a detailed inspection of the wreckage. However, photographs of the site (Figure 3) were provided to the ATSB and they showed:

• damage to the nose cone, with the propeller largely detached from the engine
• substantial damage to the cockpit windshield
• damage to both wings from contact with terrain. 

Figure 3: Aircraft damage

Source: Pilot, annotated by the ATSB

Safety analysis

During the final approach with one stage of flap selected, the aircraft’s speed reduced to a groundspeed of 56 kt and reportedly as the aircraft flew clear of a line of trees, it encountered unexpected sink. While that was possibly influenced by wind/terrain interaction at the low operating height, it was also consistent with the POH advice of increased sink at reduced airspeed. As the approach continued, despite reported engine power increases, the speed continued to reduce with the aircraft crossing the threshold at approximately 49 kt groundspeed. As there may have been some headwind component (consistent with the wind speed and direction at Sunshine Coast Airport), the indicated airspeed (IAS) may have been higher than this value, but probably below the recommended 65–60 kt during the final stages of the approach and crossing the threshold. 

On touchdown the aircraft reportedly encountered a left crosswind gust that the pilot was unable to counter, resulting in the aircraft turning right towards the house to the south of the runway. 

It is likely that the pilot was surprised by divergence as, although they applied full power to conduct a go‑around, they did not realign the aircraft with the runway, resulting in the aircraft becoming airborne heading towards obstacles. A pilot’s decision making can take up to 4 seconds to perceive and react to an unexpected action and in this time frame the aircraft had travelled towards the obstacles.

As the aircraft likely became airborne at less than the best angle of climb airspeed, V_X (65 kt IAS) the available climb performance was relatively poor and due to the immediate proximity of obstacles, there was limited ability to accelerate to V_X via a shallow climb profile. Consequently, the aircraft’s speed and height remained low, resulting in the aircraft striking the top of the tree close to the stall speed, before colliding with terrain.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving a Glastar, VH-BAQ, about 18 km north‑west of Noosa, Queensland, on 12 November 2023.

Contributing factors

• On touchdown the aircraft reportedly encountered a left crosswind gust that turned the aircraft towards obstacles to the south of the runway. 
• During the go‑around, the aircraft was not realigned with the runway and the best angle of climb airspeed was not achieved, resulting in a collision with terrain.    

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot  
• recorded data from the GPS unit (OzRunways) onboard the aircraft.
• Bureau of Meteorology 

References

Federal Aviation Administration 2004, Airplane Flying Handbook, Chapter 2-14, page 53, United States Department of Transportation.

Martin, WL, Murray, PS & Bates, PR 2012, The Effects of Startle on Pilots During Critical Events: A Case Study Analysis, Brisbane, Griffith University.

Stoddard-Hamilton Aircraft, Inc. 1998, GlaStar Model GS-1 Tricycle Gear Owner's Manual, P/N 063-02001-01, Stoddard-Hamilton Aircraft, Inc., Arlington, WA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the pilot
• Civil Aviation Safety Authority 

No submissions were received.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On the morning of 10 November 2023, a Cessna 421C, registered VH-VPY, departed the Sunshine Coast Airport, Queensland for a transpacific international ferry flight to Oakland, California in the United States. Two pilots were on board to conduct the flight, where the first leg was planned to stop at Pago Pago, American Samoa. The aircraft was configured with additional ferry fuel tanks to ensure sufficient fuel was available between the stops for the extended journey across the open ocean. 

Approximately 50 minutes after departure, the left engine failed and the pilots initiated a return to the Sunshine Coast. During the return leg the pilots identified that the aircraft was unable to maintain altitude and calculations based on the descent rate indicated they would be unable to reach the Sunshine Coast. The pilots notified air traffic control of their intention to ditch, who immediately engaged the national search and rescue service provider. 

After considering the configuration of the aircraft, the pilots elected not to follow the aircraft manufacturer’s guidance on ditching. They configured the aircraft to avoid a nose down attitude on touchdown and allowed their airspeed to slow before the aircraft contacted the water. Both occupants were uninjured and exited through the rear door. 

After deploying the emergency life raft, both pilots were retrieved by a rescue helicopter 32 minutes after ditching. The aircraft sank and was not recovered.

What the ATSB found

During climb, the nature of the left engine failure prevented the propeller from being feathered. The drag from the propeller, combined with the weight of the fuel onboard, reduced the one engine inoperative climb performance which resulted in a ditching being unavoidable.

In this occurrence, the pilots’ considered approach towards assessing their options and working together to maintain control of the aircraft increased the likelihood of a successful ditching.

Air traffic control and the Australian Maritime Safety Authority provided a rapid response to the emergency. Their coordination and allocation of resources minimised the pilots’ time in the water, further increasing the chances of survival. The pilots did not hold the required licence ratings and approvals to conduct the flight, and the aircraft was not compliant with the special ferry flight permit conditions, however, this did not contribute to the events that led to the aircraft ditching.

Safety message

The Civil Aviation Safety Authority has put in place regulations designed to ensure aircraft are airworthy and pilots are properly trained and qualified. When people operate outside of the rules, they remove the built-in safety defences and undetected problems are more likely to emerge.

For ferry flights where the certified maximum take-off weights are exceeded to accommodate the additional fuel for an overwater journey, pilots should be aware that if an engine failure were to occur, the available climb performance of the aircraft may not be sufficient to maintain height. There is guidance material available to assist pilots to plan and consider their survival in the event a ditching is required.

• CASA Advisory Circular AC 91-09 – Ditching
• Flight Safety Digest publication – Waterproof Flight Operations.

The pilots’ chances of surviving the ditching were enhanced by their early liaison with emergency services and their preparation of the aircraft during its descent. By ensuring the descent and airspeeds were managed prior to their contact with the water, the impact forces were minimised, allowing the pilots to exit the aircraft.

The investigation

The occurrence

On the morning of 10 November 2023, a Cessna 421C registered VH-VPY (VPY), was prepared for a transpacific ferry flight from Sunshine Coast, Queensland, to Oakland, California in the United States under the instrument flight rules (IFR). On board were the pilot in command (PIC) who held a commercial pilot licence and an aircraft maintenance engineer familiar with the aircraft who also held a commercial pilot licence. The submitted flight plan included the requirement for fuel stops at Pago Pago, American Samoa, and then at Honolulu, Hawaii. To complete the flights between these locations, the aircraft had been fitted with additional long range ferry fuel tanks that provided approximately 14 hours of endurance.[1] To account for the weight of the additional fuel, a special flight permit had been issued that allowed the flight to be conducted with a 10% increase above the maximum take-off weight of the aircraft.

The pilots had originally planned for the flight to depart Sunshine Coast Airport at 0500 local time, however rain showers delayed the departure. The crew subsequently revised the flight plan to depart after daylight when the conditions had improved. The delay meant that the aircraft would have arrived in Pago Pago after last light. On the morning of the flight, the engineer/pilot accepted an offer by the PIC to fly the aircraft based on their familiarity with the aircraft and they agreed that they would operate from the left seat where they felt most comfortable. At 0733 the aircraft departed and commenced climbing to the planned cruising altitude of flight level (FL)210.[2] For the next 49 minutes the crew reported that the aircraft performed as expected for the higher weight, and that all engine indications were normal.

About 213 km from the Australian coastline and while the aircraft was climbing through FL120, both pilots reported hearing a loud muffled bang from the left engine. The pilot in the left seat observed a large bulge to the cowling and oil streaming from the left engine. The pilots immediately completed the engine failure checks and while securing the failed engine, identified that the propeller would not fully feather.[3] 

The PIC, who was seated in the right seat, notified Brisbane Centre air traffic control (ATC) of the engine failure and advised that that they would be returning to the Sunshine Coast but would not be declaring an emergency. ATC initiated an alert phase.[4] At 0825 the crew provided an update to ATC, advising that they had shut down the left engine and that the aircraft was unable to maintain height. ATC activated the distress phase[5] and notified the Joint Rescue Coordination Centre (JRCC)[6] which immediately began coordinating a search and rescue response.

The aircraft continued to gradually descend; the pilots determined that it was unlikely they would reach land, and at 0839 the pilots declared an emergency to ATC. The pilots reported that during the return they worked to maximise their range. The pilot in the right seat called airspeeds, rates of descent and operated the radios, that then allowed the pilot in the left seat to concentrate on hand flying the aircraft. To maximise the aircraft performance, the pilots attempted to reduce the fuel on board by overfilling the wing tanks using the ferry tank provisions that then vented excess fuel overboard. 

ATC maintained regular contact with the pilots throughout the descent. They requested activation of the emergency locator transmitter and to be advised of what emergency equipment was on board the aircraft. 

Two rescue helicopters were tasked to attend to the emergency, with the first helicopter departing from Sunshine Coast Airport at 0854. A nearby Royal Flying Doctor Service (RFDS) aircraft was also routed by ATC to monitor VPY and provide updates in the event of a ditching. At 0900 the crew of VPY confirmed to ATC that they would be ditching. 

The pilots explored various configurations to minimise the rate of descent and determine the handling characteristics of the aircraft with a windmilling propeller. These tests formed the basis of their decision to attempt the ditching in a configuration that differed from the manufacturer’s guidance in the flight manual. They decided against the use of full flaps to avoid a nose low attitude, and instead, adopted a nose high attitude to achieve a slower speed for the touchdown.

The pilot flying recalled that their priority was to maintain control by keeping the aircraft tracking straight with wings level and to complete the ditching at low speed. To assist with this, they shut down the functional right engine in the final phase of the descent and glided the aircraft from approximately 200 ft above the surface of the water. The ditching occurred at 0907 and approximately 53 km from Sunshine Coast Airport (Figure 1).

Figure 1: VH-VPY flight path and key moments during the flight

Source: Google Earth and Flightradar24, annotated by the ATSB

The pilots reported that on contact with the water the aircraft initially skimmed the crest of a wave, followed by very rapid deceleration when the nose pitched into the water. Water washed over the windscreen and the aircraft settled upright in a slight nose down attitude. The crew quickly made their way back through the cabin and over the partially emptied ferry bladder fuel tank to the rear door. There they deployed the life raft before exiting into the water. 

The RFDS aircraft overflew the ditching site and provided coordinates and updates on the pilots to ATC and the inbound rescue helicopters. The first helicopter arrived on scene at 0920 and at 0939 completed winching operations to rescue the pilots (Figure 2). The aircraft sank during the rescue and was not recovered. Although uninjured, the pilots were transported to hospital for precautionary treatment.

Figure 2: VH-VPY remained partially afloat after the ditching and the pilots are nearby using the inflated life raft

Source: RACQ LifeFlight Rescue

Context

Pilot qualifications

The pilot in command (PIC) owned the aircraft and occupied the right seat during the accident flight. They were issued an Australian private aeroplane licence in 1981 prior to the CASA regulatory reform. The introduction of the flight crew licensing suite of regulations on 1 September 2014 included a transition period that expired on 31 August 2018. When the new flight operations regulations became effective, existing Civil Aviation Regulations (CAR) – Part 5 licence holders were required to transition to the new Civil Aviation Safety Regulations Part 61 licence to continue to operate. CASA stated that the PIC’s CAR 5 licence was not transferred to a Part 61 licence and was not valid at the time of the accident. 

The PIC also held a US-issued commercial pilot licence with multi-engine class rating and the appropriate design feature endorsements to operate a Cessna 421C under the instrument flight rules (IFR). They had a total flying experience of about 4,000 hours with 1,000 hours instrument flying experience and 30 hours on multi-engine aircraft. Although they had limited experience operating the aircraft model, they had completed a specific Cessna 421 initial pilot training course at a Federal Aviation Administration (FAA) approved provider that included about 16 hours of ground instruction and 10 hours of training in an FAA approved simulator.

The training covered multiple emergency scenarios in the simulator including flight with one engine inoperative. While not demonstrated in the simulator, the ground instruction covered the manufacturer’s recommended ditching procedure published in the aircraft flight manual.

Holders of a foreign flight crew licence granted by the national aviation authority of an International Civil Aviation Organization contracting state wanting to operate an Australian registered aircraft in Australian airspace were required to obtain an Australian certificate of validation.[7] The PIC did not have a certificate of validation for their FAA licence.

On review of the draft report, CASA advised:

CASA has previously provided guidance on the training pilots should complete prior to conducting flights from a seat they have not previously flown from to ensure they satisfy CASR 61.385(1) Limitations on exercise of privileges of pilot licences – general competency requirement. That is the pilot must be competent to exercise the privileges of the licence and ratings from whatever seat they occupy and may require training to comply with the reg [sic].

The pilot flying the aircraft from the left seat held an Australian commercial pilot licence with multi‑engine class rating and the appropriate design feature endorsements to operate a Cessna 421C under the visual flight rules (VFR), however, they did not hold an instrument rating. They had a total flying experience of about 1,400 hours with 500 hours on multi‑engine aircraft, and about 100 hours on type. They were also an aircraft maintenance engineer with the company that had installed the ferry tank installation in the aircraft.

Survival preparation

Neither pilot had previously conducted an extended international ferry flight over open water. In their planning for the flight they had engaged with other ferry pilots and industry professionals familiar with this type of operation to develop an understanding of what to expect from such a journey.

Following these discussions, a comprehensive suite of emergency survival equipment and personal provisions was acquired, which included:

• manual inflation lifejackets and a 2-person life raft
• personal GPS, satellite communicator and satellite phone
• handheld VHF transceiver and a portable HF radio.

Further guidance on preparation and considerations for overwater operations is included in the Flight Safety Foundation’s publication Flight Safety Digest – Waterproof Flight Operations.

Aircraft details

The Cessna Aircraft Company 421C type aircraft is a twin-engine, low-wing pressurised aircraft equipped with retractable landing gear. VH-VPY was fitted with 2 Teledyne Continental GTSIO‑520-L piston engines, each driving a 3‑bladed McCauley propellor. The aircraft was manufactured in the United States in 1979 and issued serial number 421C0688. First registered in Australia in 2013, it was purchased by the current owner in August 2020. 

The aircraft was fitted with a Micro Aerodynamics Incorporated vortex generator kit. This kit increased the maximum take-off weight (MTOW) by 129 lb to 7,579 lb and reduced the clean stall speed from 86 kt to 79 kt. 

The aircraft maintenance logbooks, current weight and balance loading system and documentation required for the ferry flight were onboard the aircraft when it sank. 

Aircraft ferry tank design and installation

The aircraft contained a main fuel tank in each wing that provided a combined fuel quantity of 810 L of Avgas. It was also fitted with one of the factory option 108 L wing locker tanks in the left engine nacelle (Figure 3). To achieve the additional endurance required between the available refuelling locations, an engineering order was obtained to install a long-range ferry fuel system. 

One 1,134 L ferry bladder tank was installed in the cabin of the aircraft and restrained to the floor by straps. The second bladder tank was installed in the nose locker and provided an additional 132 L of Avgas. The ferry fuel system fuel management controls were located on a panel behind the pilot’s seats and included electric fuel pumps and fuel control valves. The total fuel capacity of the aircraft was 2,184 L. 

The engineering organisation responsible for the design of the ferry tank system was experienced with such installations and had previously designed a similar system for another Cessna 421C. The tanks’ design data release[8] package included engineering instruction sheets, technical drawings and ferry operating instructions. Flight with the system installed was subject to the Civil Aviation Safety Authority (CASA) issuing a special (ferry) flight permit and the aircraft complying with continued airworthiness requirements detailed in CASA exemption EX90/23 Design of Temporary Modifications or Repairs (Special Flight Permit) Instrument 2023. 

The bladder tank was designed to be a top-up tank for the main fuel tanks located in the wings and did not incorporate a means to jettison or quickly drain the contents. The manufacturer of the bladder tank reported that incorporating of means to jettison introduced complexity and potential failure points in the system. Consequently, top-up systems were less prone to failure or mismanagement.

The pilots reported that the tank was tested for leaks prior to installation and again in flight.[9] No faults were identified with the system. 

The bladder tank was located in the passenger cabin of the aircraft behind the pilot and copilot seats and was restrained[10] with multiple ratchet straps to the existing seat tracks. CASA guidance relating to the restraint of the ferry equipment is covered in Advisory Circular AC 21-09 v4.1 –­­ Special Flight Permits section 5.1.4: 

The aircraft and ferry fuel system, including the restraints of internal ferry tanks against emergency landing loads, must be found safe for the intended flight.

Following the ditching, both occupants reported that the bladder tank did not move, and the aircraft remained intact.

In addition to the ferry tank bladder located in the cabin, the aircraft was configured with a 35 USG (132 L) bladder tank stored in the nose locker. This bladder tank was connected to the ferry fuel control panel. This tank and its connection was an unspecified modification to the approved ferry tank system. 

Figure 3: Fuel tanks in VPY included the main wing tanks, a left locker tank, a nose locker tank (unapproved) and the ferry tank (approved)

Source: Cessna, modified by the ATSB

Special ferry flight permit

For ferry flights where the aircraft meets all airworthiness requirements, except those that cannot be met because of an overweight condition, a special (ferry) flight permit can be issued by CASA. The issued permit for a particular flight usually contains conditions tailored to the type of operation. This is common when conducting international ferry flights in smaller aircraft.

For flights that do not exceed 110% of the certified MTOW and the type certificate holder of the aircraft or the national airworthiness authority of the state of design supports the overweight operation in writing, no further engineering evaluation is required. 

CASA had issued the owner a special flight permit and some of the listed conditions to conduct the flight included:

• the pilots must be instrument rated, current and properly rated for the aircraft
• life jackets and a life raft must be carried in a location that allows ready access in the event of a ditching
• MTOW not to exceed 110% of the manufacturer’s certified limit
• the aircraft was to be flown in VMC while above MTOW.

Weight and balance

The engineering instruction sheet for the ferry system required that a temporary loading system amendment was generated to incorporate the ferry tank installation. The pilot advised that a temporary loading system was not obtained for the flight and that the previous loading system issued in 2020 was used. A copy of the most recent weight and balance record for VPY was obtained. While this load data system expired in July 2023 and did not incorporate the ferry system, it provided the last known empty weight of VPY as 2,438.81 kg. 

The PIC reported[11] the aircraft fuel tanks contained 1,773 L (466.8 USG) of fuel prior to the occurrence flight departure. This quantity of fuel could have provided about 14 hours endurance, 2 hours more than the flight planned elapsed time of about 12 hours. In addition, the pilot reported that the addition of the nose locker tank maintained the centre of gravity within the specified limits. A copy of the flight plan and fuel planning data was requested from the PIC, however a copy was not provided to the ATSB.

ATSB’s review of the CCTV recordings and fuel bowser transaction records showed that a total of 1,732 L of fuel was uplifted into the aircraft with the fuel being distributed throughout the 5 fuel tanks. It could not be determined how much fuel was in the fuel tanks prior to being refuelled on the morning of the ferry flight.

When the aircraft departed, the ATSB determined that with the reported fuel quantity of 1,773 L (466.8 USG) on board, the aircraft was about 50 kg over the special flight permit weight limit. The weight of the emergency equipment and personal luggage carried on the flight was not available to be included, and therefore the actual weight of the aircraft was greater than calculated. ATSB’s review of the aircraft weight and balance identified that when the aircraft departed, it was probably outside the rear of normal centre of gravity envelope.

The pilots attempted to reduce the total fuel on board by overfilling the right main fuel tank using the transfer pumps. The engineering organisation specified a minimum system transfer rate of 3 L/min. When the engine failed, the aircraft had been airborne for about 50 minutes and burnt approximately 71 L from the right main wing tank (half of the total burn of 142 L). Based on the minimum transfer rate of 3 L/min, and the time the pumps would have been operating during the descent, the pumps should have transferred a minimum of 135 L. At the minimum transfer rate, the pumps would have transferred enough fuel from the bladder to overfill the right main tank by about 60 L. For flows above the minimum flow, additional fuel would have vented overboard through the right tank but the quantity of fuel could not be determined. 

Using the fuel consumption rates published in the aircraft flight manual, it was determined that the aircraft would have been about 55 kg under the ferry weight limit at the time the engine failed, and about 150 kg under the ferry weight limit when the aircraft was ditched. The weight of the aircraft was above the normal certified maximum take-off weight for the duration of the flight, up to and including the ditching.

One engine inoperative aircraft performance

On a twin-engine aircraft, feathering the propeller of a failed engine results in both a reduction in drag and a reduction in adverse yaw. A feathered propeller also leads to improved handling characteristics and the engine-out flight performance of the aircraft. The US Federal Aviation Administration FAA Airplane Flying Handbook Chapter 13: Transition to Multiengine Airplanes advises the drag and adverse yaw being produced by a windmilling[12] propeller can be equivalent to the drag produced by the entire airframe.

After the left engine had failed, the pilots reported that the propeller did not fully feather and continued to rotate (windmill). The Cessna 421 aircraft flight manual (AFM) identifies that 400 ft/min must be subtracted from the aircraft climb performance for a windmilling propeller. That performance assumes an unfeathered propeller. The effect of a partially feathered propeller is not specified, however drag produced by the rotating propeller would reduce aircraft climb performance. 

Aircraft climb performance is also significantly affected by weight. The FAA Pilot’s Handbook of Aeronautical Knowledge Chapter 11: Aircraft Performance explains why this is so.

Weight has a very pronounced effect on aircraft performance. If weight is added to an aircraft, it must fly at a higher AOA [angle of attack] to maintain a given altitude and speed. This increases the induced drag of the wings, as well as the parasite drag of the aircraft. Increased drag means that additional thrust is needed to overcome it, which in turn means that less reserve thrust is available for climbing.

Manufacturers conduct extensive flight tests to establish loading limits for their aircraft. If an aircraft is loaded beyond the certified maximum, the centre of gravity[13] limits are invalid (New Zealand CAA, 2023). Some of the effects likely to be encountered when operating an incorrectly loaded or overloaded aircraft include reduced stability and controllability issues as well as a reduced rate of climb and increased stall speed.

Ditching procedure

The Cessna 421C flight manual included an emergency procedure for ditching. The manual advised the procedure had not been flight tested and was based on best judgement. The checklist included a check to ensure the landing gear was retracted, planning the approach into wind, using full flap with sufficient power for a 300 ft/min descent rate at 105 kt and maintaining a continuous descent until touchdown in a level attitude. 

The configuration used by the pilot in this occurrence differed from that specified in the manufacturer’s procedure. They elected not to extend flaps and did not fly a constant descent rate to the ditching. Approaching the water, the aircraft was flared and allowed to slow in a nose-high attitude which permitted a controlled touchdown onto the water at 80 kt, significantly slower than the airspeed specified in the ditching checklist. 

The manufacturer advised the ATSB that the situation was unique and as such, they were unable to advise whether the pilot’s actions increased or decreased the risk during the ditching.

Background to ditching guidance

Textron Aviation reported that the ditching procedure prescribed for the Cessna 421C had been produced during the development program for certification of the aircraft, approximately 50 years prior. They advised that the ‘best judgement’ information used to develop the ditching procedure was probably sourced from the US military. Extensive information on aircraft ditching and considerations is provided in the publication National Search and Rescue Manual Volume II Planning handbook. The images and considerations in the Cessna 421C checklist are consistent with the advice provided in the handbook.

The FAA[14] reviewed ditching procedures for several transport category aircraft and found the following common considerations:

• If possible, a reduction in weight should be attempted since this would reduce the landing speed.

• Maximum flaps should be utilized to reduce touchdown speed to a minimum.

• The final rate of descent should be kept as low as possible.

• At touchdown, the aircraft should be in a specified nose up attitude. Generally this attitude is between 10 and 14 degrees.

• The final approach should be made with the aircraft straight and level, with roll correction and yaw angles below 10 degrees.

• The undercarriage should be retracted if possible.

Further analysis of ditching accidents between 1959–1995 in FAA Report AR-95/112 Transport Water Impact Part II identifies that an aircraft would be very likely to sustain little or no damage to the main fuselage if controlled contact with the water was made with a nose up attitude of between 5°–14° and at speeds below 95 kt. 

CASA Advisory Circular AC 91-09 v1.0 - Ditching provides general guidance to operators and pilots regarding ditching. It identifies that (when applicable) a ditching should be completed with the landing gear retracted. It also states:

Individual aeroplane design may have a significant effect on this outcome with aeroplanes with a significant amount of their structure ahead of the main wheels performing in a less violent manner; however, a misjudged flare may exacerbate the consequences of a ditching…

In his research of ditching occurrences, Newman (1988) identified that ditching an aircraft is normally survivable. He noted that using the proportion of ditchings that had fatalities as an indicator of risk was problematic, as in some cases the occupants may have survived the ditching but not survived during the period after egressing the aircraft. The guidance from AC 91-09 shows that in cold water, the largest threat to survivable post-ditching is a loss of body heat. Figure 4 illustrates the expected survival times at various water temperatures.

Figure 4: Upper limit of survival times in water for people wearing normal clothing

Source: CASA Advisory Circular AC 91-09 - Ditching

Emergency response

After leaving a ditched aircraft, survival is the primary consideration until rescue arrives. Prompt communication with the air traffic service provider or nearby aircraft/vessels to notify authorities is crucial to minimise the emergency response time. A summary of the emergency response is provided below in Table 1. Significantly, the rescue helicopter was airborne before VPY had ditched and onsite 13 minutes after it had ditched. While rated to be capable of holding 2 persons, the pilots reported that it was difficult for them to both fit within the raft. Both pilots were safely recovered 32 minutes after the ditching (Figure 5).

Table 1: Search and rescue activities

Figure 5: A pilot in the life raft being retrieved by a helicopter rescue crewman 

Source: RACQ LifeFlight Rescue

Safety analysis

The ATSB was unable to conduct an inspection of the aircraft and relied on the account of those involved in determining the sequence of events and contributing factors. This analysis considers the engine failure, the effect of weight on the aircraft performance, pilot preparation, the execution of the ditching and the response to the emergency.

Engine failure

Both pilots provided a similar account describing the engine failure that resulted in the sudden and complete loss of oil from the left engine. The nature of the failure prevented the left propeller from fully feathering. While the precise loss of performance with a partially feathered propeller could not be quantified, the excess drag from the unfeathered propeller reduced the available climb performance.

Weight of fuel on board

Based on the fuel figures provided by the pilot in command, when the aircraft departed the Sunshine Coast, the weight was over the gross weight limit defined in the special ferry flight permit. Following the consumption of fuel during the climb, the weight of the aircraft would have reduced to less than the maximum allowable weight. However, the weight of the aircraft was above the normal certified gross weight limit for which planning and performance data was available. 

Performance charts in the flight manual showed the negative effect of weight on climb performance. A reduction in the quantity of fuel onboard would therefore have had an accompanying increase in performance. Because there was no way to quickly reduce the quantity of fuel on board, the weight of the fuel, in combination with the one engine inoperative led to the aircraft being unable to maintain height.

Considering the distance from land where the engine failure occurred and the minimum rate of descent that the pilots were able to achieve, a ditching was unavoidable. 

Airworthiness

The aircraft weight and balance documentation had not been updated after installing the ferry system. Weight and balance calculations showed that the aircraft was above the limit specified in the ferry approval documentation and outside the normal centre of gravity envelope. While this would have resulted in reduced stability margins, the aircraft was unlikely to have exhibited any significant adverse control characteristics or instability.

By using a reputable engineering organisation familiar with the aircraft to design the ferry fuel installation, the likelihood of a technical failure related to the fuel system was reduced. However, the additional bladder tank in the nose locker was not part of the engineering organisation’s design and was therefore not compliant with the exemption to use the temporary approved modification for the purpose of ferrying the aircraft under the special flight permit. The unapproved modification did not contribute to the need for the ditching or the outcome of the ditching, however.

By not complying with the permit’s conditional limitations, the safety defences built into the assessment process were removed. While this did not contribute to the occurrence, it increased the likelihood of an adverse outcome.

Licensing

The special (ferry) flight permit required the flight to be flown under the instrument flight rules (IFR) and an IFR flight plan was submitted for the flight. The pilot flying (in the left seat) held an Australian licence with the appropriate ratings to operate the aircraft as pilot in command, however, they were not instrument rated. The pilot in command (in the right seat) held a multi‑engine instrument rating, however, they did not have the required certificate of validation for their FAA licence that would have permitted them to operate an Australian registered aircraft in Australian airspace. Based on the qualifications of the crew, it was determined that they did not hold the appropriate ratings and approvals to comply with the conditions of the special flight permit.

While this action would represent intentional non-compliance with aviation regulations, the main advantage of doing so would be to ensure the pilot with the most experience on the aircraft type was flying while the aircraft was overweight. The hazard being that an emergency early in the flight would require appropriate corrective action while the weight and performance of the aircraft was critical. 

In the context of the occurrence flight, the pilot qualifications did not contribute to the engine malfunction, or the aircraft ditching. However, the delayed departure from the Sunshine Coast in visual meteorological conditions, meant their arrival at Pago Pago would have been after dark. A VFR rated pilot operating the controls from the left seat or an IFR rated pilot operating from an unfamiliar seat on an IFR private flight increases the risks associated with loss of visual reference.

Pilot preparation

Despite not having conducted an overwater ferry flight previously, the pilots had taken measures to ensure they had a good idea of what to expect. Ditchings were not covered in general training and by engaging with industry professionals, they were able to apply their knowledge and experience to their own preparations. By carrying the appropriate survival equipment and being familiar with its use, the pilots were pre-prepared for the ditching. This improved their chances of survival while they were rescued.

Ditching

Most aircraft are not flight tested in a real-world ditching. The emergency procedure in the flight manual was based on the best judgement of the aircraft manufacturer and designers who had expert knowledge of the aircraft’s design. 

While the ditching procedure and configuration used by the pilots was not consistent with the flight manual, the method utilised considered the aircraft configuration, perceived limitations and the prevailing environmental conditions. The method used was found to be similar to that recommended for larger transport category aircraft.

Noting that the manufacturer was not able to advise whether the modified procedure employed by the crew increased or decreased the likelihood of a successful ditching, it could not be determined if the decision not to follow the manufacturer’s guidance increased the likelihood of aircraft damage/breakup when compared to the manufacturer's procedure.

The crew worked well together to ensure the aircraft was flown as efficiently as possible. This reduced the distance the aircraft was ditched from the coastline, which minimised the time taken for the rescue to be accomplished.

Emergency response

The occurrence highlights the importance for pilots to contact ATC as soon as practical. Once notified, ATC activated its distress phase protocols. The information ATC obtained from the pilots ensured that the rescue authority (AMSA) was informed and the equipment that could assist in locating the pilots had been activated or was in use.

Additionally, the early coordinated response from AMSA was initiated before the pilots had declared an emergency, with the first rescue helicopter becoming airborne even before the ditching had occurred. This early response and arrival minimised the pilots’ exposure time in the water, increasing their chances of survival.

Findings

From the evidence available, the following findings are made with respect to the ditching involving Cessna 421C, registered VH-VPY, 53 km east of the Sunshine Coast Airport, Queensland, on 10 November 2023. 

Contributing factors

• While flying over open water the left engine failed. The nature of the engine failure prevented the propeller from feathering and the excess drag from the windmilling propeller reduced the available performance of the aircraft.
• Following the engine failure, as it was not possible for the pilot to quickly jettison sufficient fuel from the ferry tank, the weight of that fuel further reduced aircraft performance, resulting in the aircraft ditching.

Other factor that increased risk

• The aircraft was loaded in excess of the weight and balance limitations imposed by the special ferry flight permit, and in addition, an unapproved modification was made to the ferry fuel system. These actions removed the defences incorporated into the ferry permit approval process and increased the likelihood of an adverse outcome.
• Both pilots did not hold the appropriate approvals and ratings to conduct the ferry flight.

Other findings

• The pilots were familiar with the survival equipment and were well prepared in the event of a ditching.
• While the pilot actions during the ditching were not consistent with the flight manual, the method utilised considered the aircraft configuration and its performance in the prevailing conditions. It could not be determined if this increased the likelihood of aircraft damage/breakup when compared to the manufacturer's procedure.
• Early communication between the pilots, air traffic control and the Australian Maritime Safety Authority’s Response Centre allowed rescue efforts to commence prior to ditching, increasing the chances of survival.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of the accident flight
• the owner of the aircraft
• Airservices Australia
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Federal Aviation Administration
• the maintenance organisation for VH-VPY
• Textron Aviation
• CASA‑approved design organisation
• the manufacturer of the fuel cell. 

References

Advisory Circular AC 21-08 v2.1–Approval of modification and repair designs under Subpart 21.M. Civil Aviation Safety Authority, December 2022.

Advisory Circular AC 21-09 v4.1 –­­ Special Flight Permits, Civil Aviation Safety Authority, December 2022.  

Advisory Circular AC 91-09 – Ditching, Civil Aviation Safety Authority, November 2021.

Civil Aviation Authority 2023, Good Aviation Practice Weight and Balance. Available at www.aviation.govt.nz

Flight Safety Foundation 2003, ‘Waterproof flight operations: A comprehensive guide for corporate, fractional, on-demand and commuter operators conducting overwater flights’, Flight Safety Digest, vol. 22–23.

Joint Chiefs of Staff Washington DC, National Search and Rescue Manual. Volume 2: Planning handbook (1991). United States.

Newman RL 1988, ‘Ditchings: A case history and a review of the record’, SAFE Journal, vol. 18, pp.6–15. 

Patel AA & Greenwood RP 1996, Transport water impact and ditching performance, US Department of Transportation Technical Report DOT/FAA/AR-95/54. 

Pilot’s operating handbook and Aeroplane Flight Manual Cessna 421C REPORT VB-760 Issued 1 November 1979, Revised 15 August 1996.

Tahliani M, Muller M 1996, Transport Water Impact Part II, US Department of Transportation Technical Report DOT/FAA/AR-95/112.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• pilots from the accident flight
• Airservices Australia
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Federal Aviation Administration
• maintenance organisation for VH-VPY
• Textron Aviation
• CASA‑approved design organisation.

Submissions were received from:

• pilots from the accident flight
• Civil Aviation Safety Authority
• CASA‑approved design organisation.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.