Circumstances:

On the day of the accident, the pilot took three of her work colleagues on a tour of the mine pits to the North of the camp. When the aircraft returned to the mine's airstrip, the pilot made a low pass over the camp with the canopy fully opened to drop water bombs, before commencing a climbing left turn to rejoin the circuit for a landing. Whilst the aircraft was climbing, the aircraft stalled. The pilot could not regain control before the aircraft collided with the trees. The pilot had been previously instructed not to make low passes over the campsite. The aircraft flight manual indicates that flight with the canopy partly open, but not fully open, is permissible. The effect of a fully opened canopy on the aerodynamics of the aircraft was not determined. The pilot apparently failed to ensure that she maintained a sufficient margin above the stalling speed during the climb out following the pass. This accident was not the subject of an on-scene investigation.

Significant Factors:

The following factors were considered relevant to the development of the accident:

1. The pilot ignored previous instructions not to make low passes over the campsite.

2. The pilot operated with the aircraft canopy fully open, which may have affected the performance of the aircraft.

3. The pilot failed to maintain adequate airspeed.

4. There was insufficient height available for the pilot to recover before the aircraft collided with the trees.

The pilot and his support crew arrived at the site in the late afternoon and decided to only carry out taxi trials. This was to allow the pilot to get the feel of the controls of his recently purchased, powered hang-glider before flight testing it the next morning. During the last taxi run, it appears that the aircraft became airborne inadvertently. The aircraft climbed steeply to a height of about 150 to 200 feet. Large pitch changes were noted before the attitude stabilised in near level flight. Almost immediately, a shallow right turn commenced which rapidly deteriorated into a descending spiral. The aircraft struck trees and the ground in a vertical dive. Total flight time was 15 to 20 seconds. The pilot had held a Private Pilot Licence some 18 years previously. An offer of flight training had been made by an experienced powered hang-glider pilot, but this offer has been refused because the pilot wanted to teach himself. The control logic of the powered hang-glider was exactly opposite to that of the conventional aircraft on which the pilot had experience.

The pilot was conducting superphosphate spreading operations from a short narrow agricultural strip. During the landing roll on the trip prior to the accident the pilot felt something unusual about the landing gear so he inspected the wheels but found nothing abnormal. The oleos and torque links were not inspected. During the subsequent take off the left mainwheel and oleo strut separated from the landing gear assembly fracturing the hydraulic brake line. The pilot flew the aircraft to his base aerodrome and carried out a landing on the grass strip without further damage. An inspection of the landing gear showed that the left main torque link attachment bolt had failed allowing the oleo and wheel to separate from the landing gear assembly. The bolt was not recovered therefore the precise reason for the failure of the bolt was not determined. The investigation revealed that this is a recurring problem with this aircraft type due to shear load fatigue of the attachment bolt.

The deceased and two of her friends had gone to Toogoolawah to participate in a "First Jump" parachute training course. They arrived at about 0900 hours and after completing registration procedures joined another 18 persons on the 21 student course. The training was initially conducted by a senior parachute instructor until the acting chief instructor and another instructor arrived about an hour later. The course then proceeded under his supervision with the other two instructors assisting. Following the completion of the practical and theory parts of the course a written examination was completed by each of the students and the course was divided into smaller groups for the parachute descent from the aircraft. The first group of eight students successfully completed their descents. The parachutes were repacked and issued to the second group of seven students. Prior to them boarding the aircraft the acting chief instructor, who was performing the duties of the jumpmaster and supervising the descents from the aircraft, checked each student's equipment. When he was satisfied, the students, the jumpmaster and another experienced parachutist boarded the aircraft. The aircraft took off at 1724 hours and climbed to 3000 feet, the planned exit altitude for the students. Two students jumped successfully and the deceased then took up the exit position in the aircraft doorway. She was given the instruction to jump by the jumpmaster, who then observed her descent. He reported that the body position that she adopted, after leaving the aircraft, was not correct in that her body was not arched sufficiently. The student then rolled slightly to her right with her left arm becoming fouled with the pilot parachute used to extract the main parachute. The student then turned to fall stomach down before being pulled upright. The jumpmaster then lost sight of the student and an observer on the ground reported that she did not attempt to deploy the reserve until about five seconds before impacting the ground. The reserve parachute became entangled with the lines, bag and pilot chute of the main parachute and did not inflate. A subsequent inspection of the equipment used by the student did not find any defect or inconsistency in its operation. Students on the course indicated that most parts of the course provided adequate training for the jump. However, adverse comments were received concerning the number of students on the course and the written examination. In general, it was felt that 21 was too large a group for the organisation to train given the amount of equipment available and the necessary time restraints caused by the need for all students to complete the jump, from the one aircraft in the one day, before dark. They believed that the written examination was poorly administered and inadequate. The investigator's opinion is that the examination lacked objectivity. .

At 1810 Eastern Standard Time on 30 August 2004, a Fairchild Industries Inc. SA226-T Merlin III aircraft, registered VH-SSL, departed Bankstown, NSW on a charter flight to Glen Innes, NSW with the pilot and seven passengers on board.

The pilot reported that he manually flew the aircraft in instrument meteorological conditions during the climb to flight level (FL)160. On levelling at the cruise level, he noticed that the aircraft was flying in a slightly right-wing low attitude. The pilot said that he applied left rudder trim to level the wings and engaged the autopilot. About 2 ½ minutes later, the autopilot suddenly disengaged without warning. The aircraft then rolled rapidly to the right and entered a steep spiral descent. A review of air traffic control radar data indicated that about 50 seconds later, the aircraft levelled at 5,200 ft. After the pilot regained control of the aircraft, he reported that he noticed that the right fuel tank gauge reading was 350 kg (437.5 L) greater than the left fuel tank gauge reading, and that the aircraft was ‘very heavy on the right-hand side’. The pilot then climbed the aircraft to FL130 and diverted to Tamworth, NSW without further incident. There were no reported injuries to any of the aircraft’s occupants.

The aircraft’s fuel system included a cross-flow valve that allowed pilots to balance the fuel between the aircraft’s fuel tanks if needed. The Merlin III Aircraft Flight Manual contained the aircraft operating checklists. The BEFORE STARTING ENGINES and DESCENT checklists required that the fuel system cross-flow valve switch be closed. The pilot reported that during the diversion to Tamworth he used the cross-flow valve to reduce the fuel imbalance. A subsequent engineering examination revealed no defects in the aircraft’s fuel tanks, fuel vent systems, the cross-flow system, and the cross-flow valve.

The pilot reported that he conducted the last flight in the aircraft a few days before the occurrence flight. The fuel remaining on board the aircraft after that flight was 500 L, and the right fuel tank contained about 150 L less than the left fuel tank. The pilot believed that he might have used the fuel cross-flow valve during that flight. When the aircraft was refuelled before the occurrence flight, 700 L of fuel was added to the right tank and 550 L to the left tank to give a total fuel load of 1,750 L. The pilot reported that after the refuelling ‘the gauges were pretty well reading the same’.

The pilot of a Cessna 340 departed Bankstown, NSW at 1223 ESuT, for Townsville, Qld via Walgett, St George, Roma, Emerald and Clermont. He reported that he climbed the aircraft to 16,000 ft and adopted a long range power setting of about 49% which equated to a true air speed (TAS) of 168 kts and a fuel burn of 141 lbs per hour.

As the pilot approached the ‘OLDER’ waypoint north of Clermont, he reviewed his fuel situation and, because of a strong tailwind decided to continue on to Cairns. He informed an enroute controller of his decision and requested, for fuel planning purposes, a clearance to allow him to track in the opposite direction on a one-way air route. The controller was unable to approve his request but offered the pilot a direct track to Biboohra, a navigation aid 20 NM west of Cairns. The pilot accepted the amended track with the intention of later requesting a more direct route to Cairns.

About 15 minutes later, the pilot requested a more direct track, but was told to call the approach controller for a possible clearance. He contacted the approach controller and told the controller that he had minimum fuel. The controller asked the pilot if he was declaring an emergency, to which he replied affirmative. The pilot later commented that he did this in the hope of expediting his arrival. He was instructed to descend to 6,500 ft and track direct to Cairns. The controller asked the pilot if he preferred to join the runway 15 circuit via a left downwind or right downwind, to which the pilot requested to join a left downwind. The pilot later commented that the aircraft fuel flow gauges were indicating a total flow of 140 lbs per hour and the fuel quantity gauges for the selected main tanks, although wandering somewhat, were ‘displaying a healthy amount’ considering that he was about 12 NM from his destination. As the pilot approached 6,500 ft, he requested a clearance for further descent, to which the controller instructed the pilot to descend to 4,000 ft.

As the aircraft descended to 4,000 ft, the pilot saw Cairns City, but could not see the runway at Cairns airport. The aircraft's distance measuring equipment (DME) indicated 9 NM to the DME navigation aid at Cairns Airport. The pilot reported that at about this time, he observed one of the fuel flow gauges indicating zero, while at the same time, one or both engines began to surge and run roughly. He immediately informed the controller of the situation. The controller asked the pilot if he was familiar with a local airstrip (Greenhill which is 10 NM to the southeast of Cairns airport), to which the pilot replied that he wasn't. The controller indicated to the pilot that the strip was situated in his two o'clock position at a range of about two miles and to be aware of power lines and the sugar cane. The pilot was unsure of what to look for and was unable to see the strip, but after conducting a number of steep turns, saw a cleared strip in a field. He decided that he had to land. He extended the landing gear, but realised that the aircraft was too high and attempted a 360-degree steep turn onto final to reposition the aircraft. However, the airspeed was rapidly decreasing and there was insufficient height to complete the approach. At 1729 EST, the aircraft impacted the ground short of the strip and slid for about 20 metres. The pilot was seriously injured and the passengers received minor injuries.

The ATSB did not conduct an onsite investigation. Witnesses reported that the aircraft's engines were operating just prior to the crash.

The aircraft’s fuel system included main, auxiliary and locker tanks on each wing. During normal operation each engine used fuel from either the main or auxiliary tanks on the corresponding wing. Access to the locker tank fuel was by pilot-activated transfer of the fuel from the locker tank to the same side main tank. Fuel not required by the engine was returned to the main tank regardless of which tank was selected. It was possible for fuel to vent overboard when the main tank was full and fuel was being drawn from the auxiliary tank and/or transferred from the locker tank. Each main tank contained an auxiliary fuel pump that provided fuel pressure for starting and in the event of an engine driven fuel pump failure. A transfer pump was also fitted to each main tank to continuously transfer fuel from the nose section of the tank to the centre sump area of the tank. A function of the pump was to permit steep descents with a low main tank fuel quantity. Pump operation could only be deactivated by pulling a circuit breaker.

The pilot later commented that he had checked the fuel tanks before departure and could confirm that they were full. The pilot had recently flown the aircraft from the USA to Australia.

The pilot later reported that the fuel flow indicator, that had indicated zero, had been repaired about nine months prior to the accident and although initially erratic had operated flawlessly for the last three months. He went on to say that he now has no recollection of what occurred after he descended below 4,000 ft and cannot recall the engines surging.

A number of flight plans, using reported winds from the Bureau of Meteorology, were prepared by the ATSB to consider a number of possible scenarios. These calculations included a greater fuel burn than planned by the pilot, departing with less than full tanks, incorrect fuel tank usage which could result in fuel being vented overboard or remaining in the auxiliary or locker tanks, or a different TAS and groundspeed because of power settings. The ATSB calculations indicated that the aircraft should have arrived, after a descent and straight-in approach from 16,000 ft, with about 95-100 minutes of fuel on board, if fuel management and flight planning were as reported.

At about 1020 Eastern Summer Time on 15 December 2002, a Boeing 737-400 (737) aircraft, registered VH-TJF, departed runway 35 at Canberra Airport for Melbourne. As the aircraft was rotated, the handling pilot felt that the pitch control was unusually stiff. The crew informed air traffic control of the problem and climbed the aircraft to a safe altitude in order to conduct a controllability check. The crew declared an urgency emergency phase as a precaution. The aircraft subsequently landed at Canberra Airport, at about 1115, with airport emergency services in attendance.

The operator’s maintenance personnel could not reproduce the problem on the ground. After investigation and replacement of the system B flight control module an assessment flight was conducted the following day to Melbourne Airport. That flight determined that the defect was still present and the aircraft was relocated to the operator’s maintenance facility in Melbourne for further investigation.

After an extensive investigation by the operator, the elevator binding was reproduced and found to be due to an incorrectly located elevator control cable. The control cable was hooked over the lip of a J shaped floor support beam, beneath the aft galley. The angular deflection of the cable over the floor support beam was such that the cable would only bind intermittently. The cable was repositioned and re-rigged in accordance with the manufacturer’s aircraft maintenance manual. An assessment flight was conducted and it confirmed that the defect was no longer evident.

A scheduled maintenance inspection on the 737 was completed on 13 December 2002. A review of the aircraft’s technical log indicated that on three of the eleven sectors flown since that inspection, reports of heavy and binding flight controls were noted. During the scheduled maintenance inspection completed on 13 December 2002, several flight control cables had been disconnected to carry out a modification that required the removal of the flight control columns. One of those cables was found, during the operator’s subsequent investigation, to be hooked over the aft galley floor support beam. The scheduled maintenance inspection did not require the floor panels to be removed and therefore did not allow a complete inspection of the cables after the modification was completed. Although there was no reported work carried out on the control cable system in that area, several maintenance work cards detailed maintenance near that area.

The operator conducted tests to determine how the cable might have become hooked over the J section floor support beam. With normal operating tension on the cable, a force of approximately 30 kg was required to place the cable over the beam. With only slight tension on the cable and the cable clamped, it could be readily placed over the beam. The test also determined that with the aft galley installed, as was the case, access to the location where the cable was hooked over the floor support beam was very limited.

The manufacturer’s aircraft maintenance manual contained instructions for maintaining a light tension on control cables that were disconnected but not removed. The instructions detailed the installation of cable clamps on the affected cables, to ensure that the cables do not unwind on their cable drums or become displaced from their pulley guides. If the cables were between rig pin locations, then rig pins were to be installed through the applicable cable drum or quadrant.

The aircraft manufacturer indicated that during certification of the 737, tests were performed to determine if an untensioned cable during emergency operations of the flight controls would interfere or hang up on adjacent structure. The manufacturer determined that the J section of the floor support beam did not present a risk.

The operator conducted an inspection of other 737 aircraft and found that two other configurations existed. One installation was the same as the incident aircraft but the cable was located within a plastic tube. The other installation had the floor support beam facing in the opposite direction (J section tail of the beam facing away from the cable). The manufacturer determined that the configuration of the incident aircraft was in accordance with the design drawing for the aircraft and that the floor support beam location was limited to the operator’s fleet.

History of the flights

A de Havilland DHC-8-315 (Dash 8) was being operated on a scheduled service to Mackay from Townsville under the instrument flight rules (IFR). The crew had been authorised by Brisbane Centre air traffic control to descend their aircraft to 6,000 ft. The duty runway at Mackay was 14 and, at 1503:00 Eastern Standard Time, the crew reported that they were tracking on the 304 degree radial of the Mackay VHF omni-directional radio range (VOR) navigation aid and were 30 NM from Mackay. The Mackay aerodrome controller (ADC) instructed the crew to `Report approaching 6,000 ft with DME [distance measuring equipment] distance’.

An IFR category Boeing 717-200 (717) was being operated on a scheduled service to Mackay from Brisbane. Its crew reported at 1503:22 that they were tracking on the 130 degree radial of the Mackay VOR, also on descent to 6,000 ft. The Brisbane Centre controller had assigned both crews 6,000 ft prior to instructing them to transfer to the Mackay ADC radio frequency. The assignment of the same level was an authorised practice, because the Brisbane Centre controller would continue to radar monitor the separation of all arriving aircraft until the first aircraft was at or below 5,000 ft. The ADC subsequently instructed the 717 crew to descend to 4,000 ft. The crew asked whether they could expect a left base and the ADC responded saying that they could expect a left base to runway 14.

The Dash 8 was in cloud, and at 1506:17 the ADC instructed that crew to descend to 4,700 ft. There was no separation standard being applied between the Dash 8 and the 717 and separation was no longer assured. The infringement of separation was not recognised by the Mackay ADC. The ADC instructed the 717 crew to descend to 3,000 ft and to reduce speed. The crew was told that they were number two to a Dash 8 from the north and the ADC asked them to report when visual. The Dash 8 crew reported approaching 4,700 ft at 14 DME and was instructed to descend to 2,000 ft, not below the DME steps.

At 1507:53, the crew of the 717 reported visual at 7 NM and advised that they were able to track for left base. The ADC told them to maintain 3,000 ft and to track for left downwind. The crew was asked to sight a helicopter in front of them at 2,000 ft and 4 miles east of the aerodrome. The crew replied `for the base runway 14 and looking’.

The crew of the Dash 8 reported visual (clear of cloud) and was cleared to make a visual approach straight in to runway 14 at 1508:38. The crew of the 717 was cleared for a visual approach at 1508:51. The crew of the 717 responded by reading back the clearance. The controller then said `and maintain downwind heading, the Dash 8’s currently at 9 mile’. The 717 crew neither heard, nor responded to, this subsequent transmission. The ADC did not query the lack of acknowledgment of that requirement.

Approximately 90 seconds later, the ADC observed the 717 turning left base and converging with the Dash 8 on final approach. This was a second, and more critical, infringement of separation between the two aircraft.

The crew of the Dash 8, on final approach, observed the 717 turn onto base towards their aircraft. The ADC instructed the crew of the Dash 8 to turn right, away from the 717. The ADC issued traffic information to the 717 crew who, after sighting the Dash 8, elected to maintain 1,500 ft. The ADC confirmed with the Dash 8 crew that they could see the 717 and authorised them to continue the approach. The ADC subsequently instructed the crew of the 717 to climb to 2,000 ft and make a left circuit before returning for landing.

Weather

The weather, reported as Information Golf on the automatic terminal information service, was runway 14, wind 100 degrees M at 16 kts, crosswind 10 kts, visibility greater than 10 kms, cloud scattered at 2,000 ft, showers in the area, temperature 27 degrees C and the barometric pressure at 1012 hectopascals.

The investigation report prepared by Airservices Australia indicated that although the conditions included some haze, conditions were suitable for the application of visual separation.

Airspace

Air traffic controllers from Airport Services Group, Airservices Australia, staffed Mackay Tower, which was a non-radar Class D tower. The Manual of Air Traffic Services (MATS) 9.1.2 stated that Class D airspace encompassed control zones of defined dimensions, and associated control area steps generally below 4,500 ft above mean sea level around designated aerodromes. Some of the lower levels of the Class D airspace at Mackay were below radar coverage. Airspace in the vicinity of Mackay above 4,500 ft was Class C.

In Class C and Class D airspace, an air traffic control service was provided for all IFR aircraft. In Class C airspace, a separation standard was required to be provided between all IFR aircraft, and between IFR aircraft and Visual Flight Rules (VFR) aircraft. In Class D airspace, a separation standard was required to be provided between all IFR aircraft and a separation service was required to be provided between IFR aircraft and Visual Flight Rules (VFR) aircraft airspace.

Equipment For most of the 1990s, controllers sought the provision of a radar display in towers where radar coverage was suitable. This was based on evidence that similar procedures were used in the UK in Class D towers, and in the USA in VFR Towers. Prior to the Sydney Olympics, a Tower Situational Awareness Display (TSAD) was installed in Bankstown Tower and during December 2000 test units were installed in Mackay and Rockhampton towers.

At Mackay, radar data was received by a dedicated personal computer located in the Mackay Maintenance Services division building and, after the data was processed, was relayed for display in the tower cabin. The unit displayed secondary radar returns only. The Mackay TSAD, although operating in the tower, was not approved for operational use because a safety case had not been completed. The Temporary Local Instruction (TLI AS/02/076) stated: `Controllers are reminded that until formal commissioning takes place, TSAD shall not be used in any operational sense (notwithstanding aircraft emergencies).’

Procedural separation

There was no evidence that the incident aircraft were provided with any form of procedural separation. Moreover, there was no evidence to show that the Senior Controller at Mackay or the subsequent investigation conducted by Airservices Australia identified that the ADC had not applied procedural separation standards. This oversight is not unusual, as procedural separation is a highly conceptual, rule-based air traffic control skill that demands cognitive rigour.

All IFR category aircraft in Class D airspace were to be provided with an air traffic control service. MATS defined an air traffic control service as follows: `A service provided for preventing collisions between aircraft, between aircraft and obstructions, and to expedite and maintain an orderly flow of air traffic’.

Radar control is the provision of air traffic control services using radar-derived information. Where radar is not available, procedural control is used. Procedural control is the provision of air traffic control services using information derived from sources other than radar. Such information is usually derived from pilots accurately reporting their aircraft’s position in three dimensions.

MATS stated that in a non-radar environment `controllers shall ensure that position reports are received from all aircraft in Class C and Class D airspace and for IFR flights in Class E airspace, unless: a. otherwise instructed by Air Traffic Control, or b. radar identified, or c. if the flight is specifically exempted’.

The crews of the incident aircraft were never instructed to provide a position report, which would have facilitated the selection and establishment of an appropriate procedural separation standard.

Despite the controller’s oversight in not obtaining aircraft position reports from the crews involved, the controller did provide position information about aircraft to crews. Information such as `traffic for you to sight is a Kawasaki helicopter, he’ll be in your one o’clock low at 2,000, he is 4 miles east of the field at the moment’. Another example was `maintain downwind heading, the Dash 8’s currently at 9 mile’.

Visual separation

Clearances for simultaneous visual approaches were authorised in MATS subject to certain criteria. These criteria were that the flight paths were to be greater than 90 degrees apart and that there was no significant cloud at or below the levels assigned to the aircraft. In addition, actual visibility was to be 30 km or more and both aircraft instructed to report at a distance outside the point at which lateral separation would be infringed and at which distance it was known that visual separation could be applied. The 717 and Dash 8 crews were not instructed to report outside of a lateral separation point.

After the controller had sighted both of the aircraft, the controller was authorised to separate them using visual separation as defined in MATS 4.5. Each crew was required to report when visual as a criterion to be met before they could be assigned a visual approach.

The crew of the Dash 8 was cleared for a straight in visual approach, while the crew of the 717 was tracking to join the circuit on left downwind, maintaining 3000 ft. The 717 crew was trying to sight a helicopter at 2000 ft, when they were also cleared to make a visual approach. The clearance for a visual approach authorised the crew to descend their aircraft below 3,000 ft.

MATS 4.5.2.3 stated: `When aircraft are operating visually as aerodrome traffic or in an Aerodrome Traffic Zone, ATC shall issue clearances designed to maintain separation and/or sequencing instructions, and provide traffic information’.

The controller only partially met the MATS requirement. Although the controller immediately followed up the visual approach clearance and issued a sequencing instruction: `and maintain downwind heading, the Dash 8’s currently at 9 mile’, a readback of the sequencing instruction was neither received nor requested. Traffic information on the Dash 8 was not issued to the crew of the 717.

Clearance readbacks

Air traffic controllers were required by MATS 6.1.13 to ensure that crews read all clearances, or amendment to clearances, back correctly. The accuracy of the readback was to be confirmed by the transmission of the aircraft’s callsign. Key elements of the clearances, instruction or information were to be read back. This included heading instructions.

Organisational aspects

In April 2003, Airservices Australia amended MATS to remove the requirement to pass traffic information to aircraft operating visually in the Aerodrome Traffic Zone (see Visual separation). The change was not reflected in the Manual of Standards Part 172 published by CASA and a safety case was determined to be not required. The amendment was considered by Airservices to be a more flexible requirement for traffic information when a tower controller was visually separating aircraft.

The MATS 4.5.2.3; `When aircraft are operating visually as aerodrome traffic or in an aerodrome traffic zone, ATC shall issue; (a) clearances designed to maintain separation; and/or (b) sequencing instructions; and/or (c) relevant traffic information.'

The previous version of MATS did not have the `and/or' for traffic information, it stated `and’, which indicated a mandatory rather than an optional requirement.

Shortly after commencing descent from flight level (FL) 310, the pilot of the Cessna Conquest noticed that the cabin altitude indication was rising. When passing through FL270, the cabin rate of climb rose to 3,000 ft/min with an accompanying decrease in cabin differential pressure and both master warning and "ALT" annunciators illuminating. When the annunciator lights illuminated, the pilot observed that the cabin oxygen masks had failed to auto-deploy as required. As the patients were already on oxygen and the flight nurse had donned a spare mask, he did not deploy them manually. The pilot donned his own oxygen mask and commenced a rapid descent to 10,000 ft.

The pilot reported that the cabin altitude indication increased to a peak of 17,000 ft before decreasing during the descent. A subsequent maintenance inspection found water contamination present in the cabin door seal pressurisation solenoid valve and it was suspected that this water froze, preventing the correct operation of the valve.

The failure of the oxygen mask auto-deployment system was also investigated and the wiring to the barometric activation switch was found to have a high resistance. This wiring was replaced. As a precaution, the wiring to the barometric switch that activated the cabin altitude annunciator warning light was also replaced. During these rectifications, the maintenance personnel discovered that there was no procedure published by the manufacturer to correctly adjust and test either barometric switch set-point after maintenance.

Manufacturers' maintenance manual procedures

A sampling of maintenance manual procedures for aircraft types, representative of the current Australian fleet and manufactured in countries such as the United States, United Kingdom and Switzerland was carried out. This sampling concluded that the maintenance deficiency for test and return to service of the oxygen deployment and cabin altitude alert barometric switches, found in the occurrence aircraft maintenance procedures, was also apparent in all but one of the other aircraft type manufacturer's maintenance procedures.

Regulatory requirements

The regulations currently in force in Australia state that: `CASA must issue a type acceptance certificate for an aircraft manufactured in a foreign country, without making the type certificate subject to any conditions, if a foreign type certificate or equivalent document issued by the NAA of a recognised country is in force for aircraft of that type'. CASR 21.183 deals with the issue of standard certificates of airworthiness and does not state any requirement specific to these altitude warning and oxygen deployment systems, other than that the general manufacture and modification status must conform to the production certificate or type certificate of an NAA or approved modifications to those standards.

CASA advised that, although CAO 108.26 was still in force, it was not actively applied by CASA during the Australian airworthiness certification process. CASA had introduced new legislation under CAR 22A and CAR 24 in 1990, later superseded by CASR 21.29A and CASR 21.183 respectively, that facilitated the entry to Australia of new types and models without having to comply with Australian design standards. This legislation abandoned the practice of applying Australian design standards to aircraft manufactured outside Australia and certificated in any of five major aviation countries. The Federal Aviation Administration (FAA), being the National Aviation Authority (NAA) of the United States and one of these recognised countries, has also promulgated amendments to FAR Part 25 and FAR Part 23 at amendment 23-17 that require cabin altitude warnings to trigger at 10,000 ft. CASA stated that the latest Australian legislation, in combination with the FAA Regulations, makes the requirements of CAO 108.26 Para 3.1 redundant.

On 12 July 2002, in a further response to recommendation R20000289, CASA recognised that there was scope for confusion and advised that it was considering amending CAO 108.26 to delete all requirements except the operational requirements imposed by CAO 20.4 sub-section 3 and the specification for protective breathing equipment imposed by CAO 20.4 sub-section 10. The response also stated that if CAO 108.26 is amended, the background to the amendment will be explained in an article in `Flight Safety Australia'.

History of the flight

The pilot was conducting a charter flight in the Nomad N22C aircraft with 11 persons on board from Wanggoolba Aircraft Landing Area (ALA), Fraser Island to Coolangatta. During cruise flight at 1,000 ft, approximately 2 NM north of Porpoise Point, South Stradbroke Island, the pilot noticed a slight yaw to the left and felt the aircraft decelerate. He then saw that the left engine low oil pressure and generator warning lights had illuminated. While responding to the left engine failure, the pilot noted that both low fuel pressure warning lights had illuminated and that the right engine had failed. The pilot then conducted a successful forced landing straight ahead on the northern end of Main Beach, immediately south of the Gold Coast Seaway.

After arriving at the beach landing site, the owner/chief pilot and engineering personnel inspected the aircraft, during which it was noted that the left fuel gauges indicated 120 lbs and the right fuel gauges indicated 160 lbs fuel remaining. A small amount of fuel was visible in the left fuel tank from the left filler point and no fuel was visible in the right tank. The gradient of the beach resulted in the aircraft being slightly left-wing low. Operator personnel used jerry cans to add a total of 178 L of avtur to the aircraft and bled air from both the left and right fuel lines. The owner/chief pilot then flew the aircraft from the beach to Coolangatta.

After the aircraft arrived back at Coolangatta, engineers disconnected the fuel lines from the engine-driven fuel pumps and ran the electric fuel pumps until the low fuel pressure lights illuminated, indicating that fuel was no longer being pumped. The fuel debi-meter indicated that 192 lbs, or approximately 107 L of fuel had been recovered. The estimated fuel consumption for the flight from the beach to Coolangatta was approximately 40 L, leaving approximately 30 L of the 178 L added on the beach unaccounted for. The aircraft flight manual stated that total unusable fuel was 19 L. No evidence of a fuel leak was identified. Although Operator personnel conducted a comprehensive engineering inspection of the aircraft's fuel system, the missing fuel could not be accounted for.

The incident flight was the aircraft's first commercial flight following a period of maintenance work during which engineers had ground run the aircraft several times and the owner/chief pilot had conducted two test flights.

Fuel

Before departing Coolangatta on the first leg of the days flying, the pilot had noted the fuel gauge indications and calculated that he required 200 L to attain full tanks. He then asked the refueller to add 120 L to the left tank and 80 L to the right tank. The pilot did not mention to the refueller that he intended to depart with full fuel tanks. After the refuelling was completed, the pilot noted that the fuel gauges indicated full, however he did not visually check the contents of the fuel tanks. The refueller later stated that neither fuel tank was full after he had added the requested amount of fuel to each tank.

The aircraft fuel system included four usable fuel tanks, two in each wing. The two tanks in each wing were filled from a single filler point. There were four fuel gauges, one for each of the four usable fuel tanks. During refuelling, it took a little time for fuel to flow from the outboard tank to the inboard tank. When asked to fill the tanks, the refueller normally had to fill one side, then fill the other side before returning to each side in turn to top them up. The refueller later commented that on the morning of the occurrence flight, he was able to add the requested amount of fuel without having to return to each tank to top it up, confirming that the aircraft fuel tanks were not full after the requested amount of fuel had been added.

During the day, the pilot landed the aircraft on three occasions at aerodromes where additional fuel was available. Based on the assumption that the aircraft was full on departure from Coolangatta, the pilot believed that the aircraft carried sufficient fuel, including reserve fuel, to complete the flight from Wanggoolba ALA to Coolangatta.

Operator pilots usually recorded fuel added, fuel on board, flight times and fuel consumed (from debi-meter indications) on a daily flight sheet. About six months prior to the incident, the Operator began using flight sheets with a carbon copy page so that the previous day's flight details were available to the pilot. Normally, the fuel details on the previous day's flight sheet could have been compared with the fuel gauge indications to provide additional information to the subsequent pilot regarding the fuel on board the aircraft. However, the details of fuel consumption during the maintenance-related ground runs and test flights had not been recorded on a flight sheet. Therefore, that information was not available to the incident pilot during his pre-flight preparations.

The operator's operations manual, section 3.5, titled "Fuel Documentation" stated that before commencing each flight or flight segment, the pilot in command shall be personally responsible for...verifying, by means of fuel gauges and visually, the total fuel on board is sufficient for the flight...". The pilot stated that he had never visually checked fuel tank contents in the Nomad, or in the Cessna Caravan, the other aircraft type he flew for the operator. The chief pilot and other operator pilots said they did not always visually check the contents of aircraft fuel tanks during pre-flight inspections.

Pilot experience and training

The pilot had accumulated a total of about 2,750 hours flying experience, of which 70 hours was in the Nomad. The majority of his recent flying was in Cessna Caravan aircraft, in which he had accumulated about 1,500 hours. The operator considered that the Caravan was equipped with a fuel quantity indicating system that was more accurate than that installed in the Nomad.

The pilot had completed his Nomad endorsement training and ICUS (in command under supervision) training with the operator. In a general sense, endorsement training was designed to provide training in the systems and characteristics of the new aircraft type, while ICUS training was designed to train the pilot in the normal operations of the aircraft type, including pre-flight inspection procedures. The pilot did not recall any discussion during his Nomad endorsement training regarding the accuracy of the Nomad fuel quantity indicating system in comparison with the Caravan. The pilot indicated that he had always calculated the amount of fuel required to be added based on fuel gauge indications. He had used this procedure when flying both the Caravan and the Nomad, and while undergoing ICUS training on the Nomad.

Microbiological contamination

Inspections of the fuel tanks identified contamination with microbiological material. There was one fuel quantity transmitter unit in each of the four useable fuel tanks. All four transmitter units were contaminated by microbiological material. The transmitter units consisted of a float inside an aluminium tube. Fuel entered the tube through small holes in the bottom of the tube, and the level of the float was electrically sensed and transmitted to the fuel gauges in the cockpit. The amount of microbiological material in the fuel quantity transmitter units was sufficient to interfere with the flow of fuel into the tube and to affect the electrical circuits at the bottom of the tube.

Various species of bacteria and fungi can grow in aircraft fuel systems given suitable temperature conditions and the availability of water and essential nutrients. In particular, cladosporium resinae fungus can grow into a "mat" at water collection points, and corrode tank lining and structural components.

The aircraft manufacturer recommended that fuel tanks and fuel quantity transmitter units be cleaned every 1,800 hours time in service. The transmitter units in VH-MSF had been cleaned less than 1,000 hours prior to the occurrence. The operator's fuel supplier at Coolangatta added fuel system icing inhibitor (FSII) to the bulk fuel supply. FSII is an effective biocide in avtur if used continuously. The operator also added a biocide to the aircraft fuel tanks each month.