The investigation

The occurrence

On the morning of 10 November 2023, a Cessna 421C registered VH-VPY (VPY), was prepared for a transpacific ferry flight from Sunshine Coast, Queensland, to Oakland, California in the United States under the instrument flight rules (IFR). On board were the pilot in command (PIC) who held a commercial pilot licence and an aircraft maintenance engineer familiar with the aircraft who also held a commercial pilot licence. The submitted flight plan included the requirement for fuel stops at Pago Pago, American Samoa, and then at Honolulu, Hawaii. To complete the flights between these locations, the aircraft had been fitted with additional long range ferry fuel tanks that provided approximately 14 hours of endurance.[1] To account for the weight of the additional fuel, a special flight permit had been issued that allowed the flight to be conducted with a 10% increase above the maximum take-off weight of the aircraft.

The pilots had originally planned for the flight to depart Sunshine Coast Airport at 0500 local time, however rain showers delayed the departure. The crew subsequently revised the flight plan to depart after daylight when the conditions had improved. The delay meant that the aircraft would have arrived in Pago Pago after last light. On the morning of the flight, the engineer/pilot accepted an offer by the PIC to fly the aircraft based on their familiarity with the aircraft and they agreed that they would operate from the left seat where they felt most comfortable. At 0733 the aircraft departed and commenced climbing to the planned cruising altitude of flight level (FL)210.[2] For the next 49 minutes the crew reported that the aircraft performed as expected for the higher weight, and that all engine indications were normal.

About 213 km from the Australian coastline and while the aircraft was climbing through FL120, both pilots reported hearing a loud muffled bang from the left engine. The pilot in the left seat observed a large bulge to the cowling and oil streaming from the left engine. The pilots immediately completed the engine failure checks and while securing the failed engine, identified that the propeller would not fully feather.[3] 

The PIC, who was seated in the right seat, notified Brisbane Centre air traffic control (ATC) of the engine failure and advised that that they would be returning to the Sunshine Coast but would not be declaring an emergency. ATC initiated an alert phase.[4] At 0825 the crew provided an update to ATC, advising that they had shut down the left engine and that the aircraft was unable to maintain height. ATC activated the distress phase[5] and notified the Joint Rescue Coordination Centre (JRCC)[6] which immediately began coordinating a search and rescue response.

The aircraft continued to gradually descend; the pilots determined that it was unlikely they would reach land, and at 0839 the pilots declared an emergency to ATC. The pilots reported that during the return they worked to maximise their range. The pilot in the right seat called airspeeds, rates of descent and operated the radios, that then allowed the pilot in the left seat to concentrate on hand flying the aircraft. To maximise the aircraft performance, the pilots attempted to reduce the fuel on board by overfilling the wing tanks using the ferry tank provisions that then vented excess fuel overboard. 

ATC maintained regular contact with the pilots throughout the descent. They requested activation of the emergency locator transmitter and to be advised of what emergency equipment was on board the aircraft. 

Two rescue helicopters were tasked to attend to the emergency, with the first helicopter departing from Sunshine Coast Airport at 0854. A nearby Royal Flying Doctor Service (RFDS) aircraft was also routed by ATC to monitor VPY and provide updates in the event of a ditching. At 0900 the crew of VPY confirmed to ATC that they would be ditching. 

The pilots explored various configurations to minimise the rate of descent and determine the handling characteristics of the aircraft with a windmilling propeller. These tests formed the basis of their decision to attempt the ditching in a configuration that differed from the manufacturer’s guidance in the flight manual. They decided against the use of full flaps to avoid a nose low attitude, and instead, adopted a nose high attitude to achieve a slower speed for the touchdown.

The pilot flying recalled that their priority was to maintain control by keeping the aircraft tracking straight with wings level and to complete the ditching at low speed. To assist with this, they shut down the functional right engine in the final phase of the descent and glided the aircraft from approximately 200 ft above the surface of the water. The ditching occurred at 0907 and approximately 53 km from Sunshine Coast Airport (Figure 1).

Figure 1: VH-VPY flight path and key moments during the flight

Source: Google Earth and Flightradar24, annotated by the ATSB

The pilots reported that on contact with the water the aircraft initially skimmed the crest of a wave, followed by very rapid deceleration when the nose pitched into the water. Water washed over the windscreen and the aircraft settled upright in a slight nose down attitude. The crew quickly made their way back through the cabin and over the partially emptied ferry bladder fuel tank to the rear door. There they deployed the life raft before exiting into the water. 

The RFDS aircraft overflew the ditching site and provided coordinates and updates on the pilots to ATC and the inbound rescue helicopters. The first helicopter arrived on scene at 0920 and at 0939 completed winching operations to rescue the pilots (Figure 2). The aircraft sank during the rescue and was not recovered. Although uninjured, the pilots were transported to hospital for precautionary treatment.

Figure 2: VH-VPY remained partially afloat after the ditching and the pilots are nearby using the inflated life raft

Source: RACQ LifeFlight Rescue

Context

Pilot qualifications

The pilot in command (PIC) owned the aircraft and occupied the right seat during the accident flight. They were issued an Australian private aeroplane licence in 1981 prior to the CASA regulatory reform. The introduction of the flight crew licensing suite of regulations on 1 September 2014 included a transition period that expired on 31 August 2018. When the new flight operations regulations became effective, existing Civil Aviation Regulations (CAR) – Part 5 licence holders were required to transition to the new Civil Aviation Safety Regulations Part 61 licence to continue to operate. CASA stated that the PIC’s CAR 5 licence was not transferred to a Part 61 licence and was not valid at the time of the accident. 

The PIC also held a US-issued commercial pilot licence with multi-engine class rating and the appropriate design feature endorsements to operate a Cessna 421C under the instrument flight rules (IFR). They had a total flying experience of about 4,000 hours with 1,000 hours instrument flying experience and 30 hours on multi-engine aircraft. Although they had limited experience operating the aircraft model, they had completed a specific Cessna 421 initial pilot training course at a Federal Aviation Administration (FAA) approved provider that included about 16 hours of ground instruction and 10 hours of training in an FAA approved simulator.

The training covered multiple emergency scenarios in the simulator including flight with one engine inoperative. While not demonstrated in the simulator, the ground instruction covered the manufacturer’s recommended ditching procedure published in the aircraft flight manual.

Holders of a foreign flight crew licence granted by the national aviation authority of an International Civil Aviation Organization contracting state wanting to operate an Australian registered aircraft in Australian airspace were required to obtain an Australian certificate of validation.[7] The PIC did not have a certificate of validation for their FAA licence.

On review of the draft report, CASA advised:

CASA has previously provided guidance on the training pilots should complete prior to conducting flights from a seat they have not previously flown from to ensure they satisfy CASR 61.385(1) Limitations on exercise of privileges of pilot licences – general competency requirement. That is the pilot must be competent to exercise the privileges of the licence and ratings from whatever seat they occupy and may require training to comply with the reg [sic].

The pilot flying the aircraft from the left seat held an Australian commercial pilot licence with multi‑engine class rating and the appropriate design feature endorsements to operate a Cessna 421C under the visual flight rules (VFR), however, they did not hold an instrument rating. They had a total flying experience of about 1,400 hours with 500 hours on multi‑engine aircraft, and about 100 hours on type. They were also an aircraft maintenance engineer with the company that had installed the ferry tank installation in the aircraft.

Survival preparation

Neither pilot had previously conducted an extended international ferry flight over open water. In their planning for the flight they had engaged with other ferry pilots and industry professionals familiar with this type of operation to develop an understanding of what to expect from such a journey.

Following these discussions, a comprehensive suite of emergency survival equipment and personal provisions was acquired, which included:

• manual inflation lifejackets and a 2-person life raft
• personal GPS, satellite communicator and satellite phone
• handheld VHF transceiver and a portable HF radio.

Further guidance on preparation and considerations for overwater operations is included in the Flight Safety Foundation’s publication Flight Safety Digest – Waterproof Flight Operations.

Aircraft details

The Cessna Aircraft Company 421C type aircraft is a twin-engine, low-wing pressurised aircraft equipped with retractable landing gear. VH-VPY was fitted with 2 Teledyne Continental GTSIO‑520-L piston engines, each driving a 3‑bladed McCauley propellor. The aircraft was manufactured in the United States in 1979 and issued serial number 421C0688. First registered in Australia in 2013, it was purchased by the current owner in August 2020. 

The aircraft was fitted with a Micro Aerodynamics Incorporated vortex generator kit. This kit increased the maximum take-off weight (MTOW) by 129 lb to 7,579 lb and reduced the clean stall speed from 86 kt to 79 kt. 

The aircraft maintenance logbooks, current weight and balance loading system and documentation required for the ferry flight were onboard the aircraft when it sank. 

Aircraft ferry tank design and installation

The aircraft contained a main fuel tank in each wing that provided a combined fuel quantity of 810 L of Avgas. It was also fitted with one of the factory option 108 L wing locker tanks in the left engine nacelle (Figure 3). To achieve the additional endurance required between the available refuelling locations, an engineering order was obtained to install a long-range ferry fuel system. 

One 1,134 L ferry bladder tank was installed in the cabin of the aircraft and restrained to the floor by straps. The second bladder tank was installed in the nose locker and provided an additional 132 L of Avgas. The ferry fuel system fuel management controls were located on a panel behind the pilot’s seats and included electric fuel pumps and fuel control valves. The total fuel capacity of the aircraft was 2,184 L. 

The engineering organisation responsible for the design of the ferry tank system was experienced with such installations and had previously designed a similar system for another Cessna 421C. The tanks’ design data release[8] package included engineering instruction sheets, technical drawings and ferry operating instructions. Flight with the system installed was subject to the Civil Aviation Safety Authority (CASA) issuing a special (ferry) flight permit and the aircraft complying with continued airworthiness requirements detailed in CASA exemption EX90/23 Design of Temporary Modifications or Repairs (Special Flight Permit) Instrument 2023. 

The bladder tank was designed to be a top-up tank for the main fuel tanks located in the wings and did not incorporate a means to jettison or quickly drain the contents. The manufacturer of the bladder tank reported that incorporating of means to jettison introduced complexity and potential failure points in the system. Consequently, top-up systems were less prone to failure or mismanagement.

The pilots reported that the tank was tested for leaks prior to installation and again in flight.[9] No faults were identified with the system. 

The bladder tank was located in the passenger cabin of the aircraft behind the pilot and copilot seats and was restrained[10] with multiple ratchet straps to the existing seat tracks. CASA guidance relating to the restraint of the ferry equipment is covered in Advisory Circular AC 21-09 v4.1 –­­ Special Flight Permits section 5.1.4: 

The aircraft and ferry fuel system, including the restraints of internal ferry tanks against emergency landing loads, must be found safe for the intended flight.

Following the ditching, both occupants reported that the bladder tank did not move, and the aircraft remained intact.

In addition to the ferry tank bladder located in the cabin, the aircraft was configured with a 35 USG (132 L) bladder tank stored in the nose locker. This bladder tank was connected to the ferry fuel control panel. This tank and its connection was an unspecified modification to the approved ferry tank system. 

Figure 3: Fuel tanks in VPY included the main wing tanks, a left locker tank, a nose locker tank (unapproved) and the ferry tank (approved)

Source: Cessna, modified by the ATSB

Special ferry flight permit

For ferry flights where the aircraft meets all airworthiness requirements, except those that cannot be met because of an overweight condition, a special (ferry) flight permit can be issued by CASA. The issued permit for a particular flight usually contains conditions tailored to the type of operation. This is common when conducting international ferry flights in smaller aircraft.

For flights that do not exceed 110% of the certified MTOW and the type certificate holder of the aircraft or the national airworthiness authority of the state of design supports the overweight operation in writing, no further engineering evaluation is required. 

CASA had issued the owner a special flight permit and some of the listed conditions to conduct the flight included:

• the pilots must be instrument rated, current and properly rated for the aircraft
• life jackets and a life raft must be carried in a location that allows ready access in the event of a ditching
• MTOW not to exceed 110% of the manufacturer’s certified limit
• the aircraft was to be flown in VMC while above MTOW.

Weight and balance

The engineering instruction sheet for the ferry system required that a temporary loading system amendment was generated to incorporate the ferry tank installation. The pilot advised that a temporary loading system was not obtained for the flight and that the previous loading system issued in 2020 was used. A copy of the most recent weight and balance record for VPY was obtained. While this load data system expired in July 2023 and did not incorporate the ferry system, it provided the last known empty weight of VPY as 2,438.81 kg. 

The PIC reported[11] the aircraft fuel tanks contained 1,773 L (466.8 USG) of fuel prior to the occurrence flight departure. This quantity of fuel could have provided about 14 hours endurance, 2 hours more than the flight planned elapsed time of about 12 hours. In addition, the pilot reported that the addition of the nose locker tank maintained the centre of gravity within the specified limits. A copy of the flight plan and fuel planning data was requested from the PIC, however a copy was not provided to the ATSB.

ATSB’s review of the CCTV recordings and fuel bowser transaction records showed that a total of 1,732 L of fuel was uplifted into the aircraft with the fuel being distributed throughout the 5 fuel tanks. It could not be determined how much fuel was in the fuel tanks prior to being refuelled on the morning of the ferry flight.

When the aircraft departed, the ATSB determined that with the reported fuel quantity of 1,773 L (466.8 USG) on board, the aircraft was about 50 kg over the special flight permit weight limit. The weight of the emergency equipment and personal luggage carried on the flight was not available to be included, and therefore the actual weight of the aircraft was greater than calculated. ATSB’s review of the aircraft weight and balance identified that when the aircraft departed, it was probably outside the rear of normal centre of gravity envelope.

The pilots attempted to reduce the total fuel on board by overfilling the right main fuel tank using the transfer pumps. The engineering organisation specified a minimum system transfer rate of 3 L/min. When the engine failed, the aircraft had been airborne for about 50 minutes and burnt approximately 71 L from the right main wing tank (half of the total burn of 142 L). Based on the minimum transfer rate of 3 L/min, and the time the pumps would have been operating during the descent, the pumps should have transferred a minimum of 135 L. At the minimum transfer rate, the pumps would have transferred enough fuel from the bladder to overfill the right main tank by about 60 L. For flows above the minimum flow, additional fuel would have vented overboard through the right tank but the quantity of fuel could not be determined. 

Using the fuel consumption rates published in the aircraft flight manual, it was determined that the aircraft would have been about 55 kg under the ferry weight limit at the time the engine failed, and about 150 kg under the ferry weight limit when the aircraft was ditched. The weight of the aircraft was above the normal certified maximum take-off weight for the duration of the flight, up to and including the ditching.

One engine inoperative aircraft performance

On a twin-engine aircraft, feathering the propeller of a failed engine results in both a reduction in drag and a reduction in adverse yaw. A feathered propeller also leads to improved handling characteristics and the engine-out flight performance of the aircraft. The US Federal Aviation Administration FAA Airplane Flying Handbook Chapter 13: Transition to Multiengine Airplanes advises the drag and adverse yaw being produced by a windmilling[12] propeller can be equivalent to the drag produced by the entire airframe.

After the left engine had failed, the pilots reported that the propeller did not fully feather and continued to rotate (windmill). The Cessna 421 aircraft flight manual (AFM) identifies that 400 ft/min must be subtracted from the aircraft climb performance for a windmilling propeller. That performance assumes an unfeathered propeller. The effect of a partially feathered propeller is not specified, however drag produced by the rotating propeller would reduce aircraft climb performance. 

Aircraft climb performance is also significantly affected by weight. The FAA Pilot’s Handbook of Aeronautical Knowledge Chapter 11: Aircraft Performance explains why this is so.

Weight has a very pronounced effect on aircraft performance. If weight is added to an aircraft, it must fly at a higher AOA [angle of attack] to maintain a given altitude and speed. This increases the induced drag of the wings, as well as the parasite drag of the aircraft. Increased drag means that additional thrust is needed to overcome it, which in turn means that less reserve thrust is available for climbing.

Manufacturers conduct extensive flight tests to establish loading limits for their aircraft. If an aircraft is loaded beyond the certified maximum, the centre of gravity[13] limits are invalid (New Zealand CAA, 2023). Some of the effects likely to be encountered when operating an incorrectly loaded or overloaded aircraft include reduced stability and controllability issues as well as a reduced rate of climb and increased stall speed.

Ditching procedure

The Cessna 421C flight manual included an emergency procedure for ditching. The manual advised the procedure had not been flight tested and was based on best judgement. The checklist included a check to ensure the landing gear was retracted, planning the approach into wind, using full flap with sufficient power for a 300 ft/min descent rate at 105 kt and maintaining a continuous descent until touchdown in a level attitude. 

The configuration used by the pilot in this occurrence differed from that specified in the manufacturer’s procedure. They elected not to extend flaps and did not fly a constant descent rate to the ditching. Approaching the water, the aircraft was flared and allowed to slow in a nose-high attitude which permitted a controlled touchdown onto the water at 80 kt, significantly slower than the airspeed specified in the ditching checklist. 

The manufacturer advised the ATSB that the situation was unique and as such, they were unable to advise whether the pilot’s actions increased or decreased the risk during the ditching.

Background to ditching guidance

Textron Aviation reported that the ditching procedure prescribed for the Cessna 421C had been produced during the development program for certification of the aircraft, approximately 50 years prior. They advised that the ‘best judgement’ information used to develop the ditching procedure was probably sourced from the US military. Extensive information on aircraft ditching and considerations is provided in the publication National Search and Rescue Manual Volume II Planning handbook. The images and considerations in the Cessna 421C checklist are consistent with the advice provided in the handbook.

The FAA[14] reviewed ditching procedures for several transport category aircraft and found the following common considerations:

• If possible, a reduction in weight should be attempted since this would reduce the landing speed.

• Maximum flaps should be utilized to reduce touchdown speed to a minimum.

• The final rate of descent should be kept as low as possible.

• At touchdown, the aircraft should be in a specified nose up attitude. Generally this attitude is between 10 and 14 degrees.

• The final approach should be made with the aircraft straight and level, with roll correction and yaw angles below 10 degrees.

• The undercarriage should be retracted if possible.

Further analysis of ditching accidents between 1959–1995 in FAA Report AR-95/112 Transport Water Impact Part II identifies that an aircraft would be very likely to sustain little or no damage to the main fuselage if controlled contact with the water was made with a nose up attitude of between 5°–14° and at speeds below 95 kt. 

CASA Advisory Circular AC 91-09 v1.0 - Ditching provides general guidance to operators and pilots regarding ditching. It identifies that (when applicable) a ditching should be completed with the landing gear retracted. It also states:

Individual aeroplane design may have a significant effect on this outcome with aeroplanes with a significant amount of their structure ahead of the main wheels performing in a less violent manner; however, a misjudged flare may exacerbate the consequences of a ditching…

In his research of ditching occurrences, Newman (1988) identified that ditching an aircraft is normally survivable. He noted that using the proportion of ditchings that had fatalities as an indicator of risk was problematic, as in some cases the occupants may have survived the ditching but not survived during the period after egressing the aircraft. The guidance from AC 91-09 shows that in cold water, the largest threat to survivable post-ditching is a loss of body heat. Figure 4 illustrates the expected survival times at various water temperatures.

Figure 4: Upper limit of survival times in water for people wearing normal clothing

Source: CASA Advisory Circular AC 91-09 - Ditching

Emergency response

After leaving a ditched aircraft, survival is the primary consideration until rescue arrives. Prompt communication with the air traffic service provider or nearby aircraft/vessels to notify authorities is crucial to minimise the emergency response time. A summary of the emergency response is provided below in Table 1. Significantly, the rescue helicopter was airborne before VPY had ditched and onsite 13 minutes after it had ditched. While rated to be capable of holding 2 persons, the pilots reported that it was difficult for them to both fit within the raft. Both pilots were safely recovered 32 minutes after the ditching (Figure 5).

Table 1: Search and rescue activities

Figure 5: A pilot in the life raft being retrieved by a helicopter rescue crewman 

Source: RACQ LifeFlight Rescue

Safety analysis

The ATSB was unable to conduct an inspection of the aircraft and relied on the account of those involved in determining the sequence of events and contributing factors. This analysis considers the engine failure, the effect of weight on the aircraft performance, pilot preparation, the execution of the ditching and the response to the emergency.

Engine failure

Both pilots provided a similar account describing the engine failure that resulted in the sudden and complete loss of oil from the left engine. The nature of the failure prevented the left propeller from fully feathering. While the precise loss of performance with a partially feathered propeller could not be quantified, the excess drag from the unfeathered propeller reduced the available climb performance.

Weight of fuel on board

Based on the fuel figures provided by the pilot in command, when the aircraft departed the Sunshine Coast, the weight was over the gross weight limit defined in the special ferry flight permit. Following the consumption of fuel during the climb, the weight of the aircraft would have reduced to less than the maximum allowable weight. However, the weight of the aircraft was above the normal certified gross weight limit for which planning and performance data was available. 

Performance charts in the flight manual showed the negative effect of weight on climb performance. A reduction in the quantity of fuel onboard would therefore have had an accompanying increase in performance. Because there was no way to quickly reduce the quantity of fuel on board, the weight of the fuel, in combination with the one engine inoperative led to the aircraft being unable to maintain height.

Considering the distance from land where the engine failure occurred and the minimum rate of descent that the pilots were able to achieve, a ditching was unavoidable. 

Airworthiness

The aircraft weight and balance documentation had not been updated after installing the ferry system. Weight and balance calculations showed that the aircraft was above the limit specified in the ferry approval documentation and outside the normal centre of gravity envelope. While this would have resulted in reduced stability margins, the aircraft was unlikely to have exhibited any significant adverse control characteristics or instability.

By using a reputable engineering organisation familiar with the aircraft to design the ferry fuel installation, the likelihood of a technical failure related to the fuel system was reduced. However, the additional bladder tank in the nose locker was not part of the engineering organisation’s design and was therefore not compliant with the exemption to use the temporary approved modification for the purpose of ferrying the aircraft under the special flight permit. The unapproved modification did not contribute to the need for the ditching or the outcome of the ditching, however.

By not complying with the permit’s conditional limitations, the safety defences built into the assessment process were removed. While this did not contribute to the occurrence, it increased the likelihood of an adverse outcome.

Licensing

The special (ferry) flight permit required the flight to be flown under the instrument flight rules (IFR) and an IFR flight plan was submitted for the flight. The pilot flying (in the left seat) held an Australian licence with the appropriate ratings to operate the aircraft as pilot in command, however, they were not instrument rated. The pilot in command (in the right seat) held a multi‑engine instrument rating, however, they did not have the required certificate of validation for their FAA licence that would have permitted them to operate an Australian registered aircraft in Australian airspace. Based on the qualifications of the crew, it was determined that they did not hold the appropriate ratings and approvals to comply with the conditions of the special flight permit.

While this action would represent intentional non-compliance with aviation regulations, the main advantage of doing so would be to ensure the pilot with the most experience on the aircraft type was flying while the aircraft was overweight. The hazard being that an emergency early in the flight would require appropriate corrective action while the weight and performance of the aircraft was critical. 

In the context of the occurrence flight, the pilot qualifications did not contribute to the engine malfunction, or the aircraft ditching. However, the delayed departure from the Sunshine Coast in visual meteorological conditions, meant their arrival at Pago Pago would have been after dark. A VFR rated pilot operating the controls from the left seat or an IFR rated pilot operating from an unfamiliar seat on an IFR private flight increases the risks associated with loss of visual reference.

Pilot preparation

Despite not having conducted an overwater ferry flight previously, the pilots had taken measures to ensure they had a good idea of what to expect. Ditchings were not covered in general training and by engaging with industry professionals, they were able to apply their knowledge and experience to their own preparations. By carrying the appropriate survival equipment and being familiar with its use, the pilots were pre-prepared for the ditching. This improved their chances of survival while they were rescued.

Ditching

Most aircraft are not flight tested in a real-world ditching. The emergency procedure in the flight manual was based on the best judgement of the aircraft manufacturer and designers who had expert knowledge of the aircraft’s design. 

While the ditching procedure and configuration used by the pilots was not consistent with the flight manual, the method utilised considered the aircraft configuration, perceived limitations and the prevailing environmental conditions. The method used was found to be similar to that recommended for larger transport category aircraft.

Noting that the manufacturer was not able to advise whether the modified procedure employed by the crew increased or decreased the likelihood of a successful ditching, it could not be determined if the decision not to follow the manufacturer’s guidance increased the likelihood of aircraft damage/breakup when compared to the manufacturer's procedure.

The crew worked well together to ensure the aircraft was flown as efficiently as possible. This reduced the distance the aircraft was ditched from the coastline, which minimised the time taken for the rescue to be accomplished.

Emergency response

The occurrence highlights the importance for pilots to contact ATC as soon as practical. Once notified, ATC activated its distress phase protocols. The information ATC obtained from the pilots ensured that the rescue authority (AMSA) was informed and the equipment that could assist in locating the pilots had been activated or was in use.

Additionally, the early coordinated response from AMSA was initiated before the pilots had declared an emergency, with the first rescue helicopter becoming airborne even before the ditching had occurred. This early response and arrival minimised the pilots’ exposure time in the water, increasing their chances of survival.

Findings

From the evidence available, the following findings are made with respect to the ditching involving Cessna 421C, registered VH-VPY, 53 km east of the Sunshine Coast Airport, Queensland, on 10 November 2023. 

Contributing factors

• While flying over open water the left engine failed. The nature of the engine failure prevented the propeller from feathering and the excess drag from the windmilling propeller reduced the available performance of the aircraft.
• Following the engine failure, as it was not possible for the pilot to quickly jettison sufficient fuel from the ferry tank, the weight of that fuel further reduced aircraft performance, resulting in the aircraft ditching.

Other factor that increased risk

• The aircraft was loaded in excess of the weight and balance limitations imposed by the special ferry flight permit, and in addition, an unapproved modification was made to the ferry fuel system. These actions removed the defences incorporated into the ferry permit approval process and increased the likelihood of an adverse outcome.
• Both pilots did not hold the appropriate approvals and ratings to conduct the ferry flight.

Other findings

• The pilots were familiar with the survival equipment and were well prepared in the event of a ditching.
• While the pilot actions during the ditching were not consistent with the flight manual, the method utilised considered the aircraft configuration and its performance in the prevailing conditions. It could not be determined if this increased the likelihood of aircraft damage/breakup when compared to the manufacturer's procedure.
• Early communication between the pilots, air traffic control and the Australian Maritime Safety Authority’s Response Centre allowed rescue efforts to commence prior to ditching, increasing the chances of survival.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of the accident flight
• the owner of the aircraft
• Airservices Australia
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Federal Aviation Administration
• the maintenance organisation for VH-VPY
• Textron Aviation
• CASA‑approved design organisation
• the manufacturer of the fuel cell. 

References

Advisory Circular AC 21-08 v2.1–Approval of modification and repair designs under Subpart 21.M. Civil Aviation Safety Authority, December 2022.

Advisory Circular AC 21-09 v4.1 –­­ Special Flight Permits, Civil Aviation Safety Authority, December 2022.  

Advisory Circular AC 91-09 – Ditching, Civil Aviation Safety Authority, November 2021.

Civil Aviation Authority 2023, Good Aviation Practice Weight and Balance. Available at www.aviation.govt.nz

Flight Safety Foundation 2003, ‘Waterproof flight operations: A comprehensive guide for corporate, fractional, on-demand and commuter operators conducting overwater flights’, Flight Safety Digest, vol. 22–23.

Joint Chiefs of Staff Washington DC, National Search and Rescue Manual. Volume 2: Planning handbook (1991). United States.

Newman RL 1988, ‘Ditchings: A case history and a review of the record’, SAFE Journal, vol. 18, pp.6–15. 

Patel AA & Greenwood RP 1996, Transport water impact and ditching performance, US Department of Transportation Technical Report DOT/FAA/AR-95/54. 

Pilot’s operating handbook and Aeroplane Flight Manual Cessna 421C REPORT VB-760 Issued 1 November 1979, Revised 15 August 1996.

Tahliani M, Muller M 1996, Transport Water Impact Part II, US Department of Transportation Technical Report DOT/FAA/AR-95/112.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• pilots from the accident flight
• Airservices Australia
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Federal Aviation Administration
• maintenance organisation for VH-VPY
• Textron Aviation
• CASA‑approved design organisation.

Submissions were received from:

• pilots from the accident flight
• Civil Aviation Safety Authority
• CASA‑approved design organisation.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

On 31 October 2023, several active fires were burning in the Tenterfield area of New South Wales (NSW). By that afternoon, up to 21 NSW Rural Fire Service (RFS) aircraft, including 3 large air tankers and their lead plane (birddog) were deployed to the area to assist with fire control. Concurrently, Queensland (Qld) Fire and Emergency Services (QFES) had deployed aerial assets to an adjacent fireground on the NSW/Qld border.

The crews of the NSW RFS birddog and the large air tankers reported multiple incidents of being unable to communicate and coordinate with other aircraft at the firegrounds. Multiple occurrences of unsafe aircraft proximity were also reported. 

What the ATSB found

The ATSB identified that as the fire activity increased in the early afternoon, the state operations controller (SOC) proactively dispatched 3 large air tankers to the region without a target and without coordinating with the local incident management team to ensure they could be effectively integrated into the existing local incident plan. The SOC likely assumed that the large air tankers would be coordinated by the air attack supervisor (AAS) in the Tenterfield area when they arrived. However, most likely due to the communication breakdown, the AAS was not aware the air tankers were inbound. Further, when they arrived, the AAS was about to depart the fireground for fuel and did not advise the incoming Birddog AAS (dispatched with the large air tankers) of the known traffic in the area.

The ATSB also identified that the NSW RFS had inadequate guidance to ensure there was consideration given to the continuity of aerial supervision if the AAS was required to depart the fireground. There was also no mechanism to assess whether increased aerial supervision was required when aircraft numbers and/or fire complexity increased.

In addition, the NSW RFS had no procedure to ensure that fire common traffic advisory frequencies (Fire-CTAFs) were reliably known by state air desk personnel. As a result, when the 3 large air tankers were dispatched to the area, they were provided with incomplete Fire‑CTAF information. 

In combination, this resulted in the large air tankers having no target information, incomplete traffic information and operating on the incorrect frequency. Additionally, NSW RFS and QFES were operating in proximity on the NSW/Qld border with, initially, no communication or coordination.

The ATSB also identified safety issues associated with the inconsistent understanding within the NSW RFS state air desk of the threshold required to action task rejection procedures when safety concerns were raised. Also as there was no procedure for implementing a temporary restricted area, there was an increased risk of an air proximity event with aircraft not associated with firefighting operations. 

What has been done as a result

Following the events that occurred near Tenterfield on 31 October 2023, the NSW RFS introduced extensive systemic-level safety improvements to its operations.

This included the introduction of a policy to ensure that pilots in command of large air tankers receive a briefing from the incident management team regarding incident strategy prior to departure. It has also developed new procedures for state air desk and incident management team (IMT) liaison, and structured communication loops between the IMT and air attack supervisors.

Further, NSW RFS has issued a directive that requires regular assessment of operational complexity, environmental conditions and the number of aircraft dispatched to a fireground to ensure that aerial supervision arrangements remain appropriate. 

Issues around the implementation of a temporary restricted area (TRA) and recording Fire‑CTAF information have also been addressed. 

In addition, the National Aerial Firefighting Centre (NAFC) developed the national cross‑border airspace management guideline (released in January 2024), which involved all jurisdictions. This guideline established common procedures for frequency alignment, air desk-to-air desk liaison, cross-border tasking triggers, and shared TRA/TFR activation.

Refer to the section titled Safety issues and actionsfor a full list of proactive safety actions taken.  

Safety message

As noted by the National Aerial Firefighting Centre, aerial firefighting is a critical capability for the management and suppression of bushfires in Australia. To effectively achieve this, multiple aircraft are flown at low altitudes and varying airspeeds, often in challenging environmental conditions. This creates a high-risk environment, which requires a continued focus on risk mitigation.

As previously identified in ATSB investigation AO-2020-007, at a large fireground it is likely there will be personnel and assets from multiple organisations and jurisdictions interacting. In this scenario, non-standard procedures and practices may result in unforeseen risks emerging. It is therefore critically important for tasking agencies to take the lead, with the support of stakeholders, in developing the quality and safety standards they require for the firefighting effort to mitigate operational risks.

Further, the adoption of robust systems for managing risk by the tasking agency provides an additional layer of defence, above that provided by each aircraft operator. This also ensures that one aspect of the operation does not compromise another. This may include the development of procedures to support decision-making processes rather than personnel having to exercise judgement based on their experience, skills and knowledge. This includes tasking decisions, task rejection procedures, and minimum aerial supervision requirements.

Summary video

The occurrence

Introduction

Aerial firefighting is a critical capability for the management and suppression of bushfires in Australia. To effectively achieve this, multiple aircraft often operate together over inhospitable terrain at low altitudes and varying airspeeds with reduced visibility from smoke. This hazardous environment ‘requires an enduring focus on training, compliance, and risk mitigation’ (National Aerial Firefighting Centre (NAFC), 2021).

After firefighting operations in the Tenterfield area of New South Wales (NSW) on 31 October 2023, the ATSB received multiple reports of proximity incidents between firefighting aircraft dispatched to the area and initiated an investigation, including a detailed review of the flight data (see the section titled Recorded data). 

Following interviews with key personnel, a review of communications, dispatch and communication procedures, and written submissions from operators involved on the day, the ATSB identified several risks associated with communications and coordination between the state air desk and the incident management team and between the state air desk and the aircraft dispatched to the fireground. As such, these risks became the focus of the investigation. The proximity incidents were considered consequential to these risks.

Background

In the days leading up to 31 October 2023, extreme fire weather,[1] critically dry fuels, and multiple simultaneous fire escalations combined across the Tenterfield, Inverell, and Glen Innes Severn Local Government Areas (LGA). The NSW Rural Fire Service (NSW RFS) advised this created one of the most challenging operational environments encountered during the 2023 fire season.

By midday on 31 October, the RFS State Operations Centre reported 93 active incidents across NSW, including 77 bush and grass fires, with 25 still to be contained. There were also 6 concurrent Section 44[2] bushfire emergency declarations, one of which covered the Inverell/Tenterfield LGAs. 

To meet these escalating demands, 617 personnel, 167 appliances, 39 heavy plant units and 45 aircraft were deployed across the state. Despite this, resourcing remained critical. 

The Tenterfield LGA recorded 10 active fires, many of which escalated during the afternoon under the influence of strong winds and critically dry fuels. By evening, 6 fires had reached Emergency Warning level, and 8 Emergency Alerts were issued, including for new ignitions, such as the Christies fire on the NSW/Qld border. 

The key fires in the LGA included: 

• Benders Creek Fire – made significant afternoon runs, jumped the New England Highway (closing the road), and escalated to Emergency Warning with a Seek Shelter message.
• Sawyers Creek Fire – breached containment, crossed the Bruxner Highway and threatened properties west of Tenterfield.
• Frost Road Fire – escalated from Watch and Act to Emergency Warning during the day as it crossed Woodside Road and threatened the Sunnyside area.
• Ogilvie Drive Fire (Tabulam) – crossed the Clarence River, destroyed several structures and forced Emergency Alerts for downstream communities.
• Christies Fire (Jennings/Wallangarra) – ignited in Queensland, crossed into NSW and impacted the towns of Wallangarra (Queensland) and Jennings (NSW), resulting in property losses, power outages, and residents sheltering in place under direct fire impact. 

An incident management team (IMT) (see the section titled Incident management team) had been established at Glen Innes, NSW, to coordinate firefighting activities in the region. There were many roles involved in the NSW RFS response; for simplicity, only the most relevant roles applicable on the day, in the regions involved, are discussed in this report. 

The IMT included an incident controller (IC), responsible for the overall fire management, an air operations manager (AOM), responsible for coordination of aviation resources, and 2 air attack supervisors (AAS) (see the section titled Air attack supervisor) operating in helicopters over the firegrounds, conducting tactical aircraft coordination. 

As part of the daily morning briefing at the IMT, aerial crews deployed to the Tenterfield area were advised that there were 3 fire common traffic advisory frequencies (Fire‑CTAFs)[3] (see the section titled Fire common traffic advisory frequencies) and were provided the corresponding boundaries in use that day (Figure 1). These frequencies were allocated to help with communication in anticipation of the high number of aircraft expected to be operating in the area. The Fire-CTAFs in operation were the:

• northern area containing Jennings (118.65)
• southern area containing Tenterfield (123.65)
• western area (124.45). 

Although the 3 Fire-CTAFs had been issued by the NSW RFS state air desk (SAD) (see the section titled State air desk) in Sydney the previous evening, the personnel manning the SAD on the morning of 31 October 2023 were only aware of the southern Tenterfield Fire-CTAF (123.65). 

Figure 1: Map of NSW Fire-CTAFs in the Tenterfield area on 31 October 2023

Source: NSW RFS, annotated by the ATSB 

In total, there were up to 18 aerial assets deployed by the NSW RFS to the region throughout the morning.[4] The AAS in Firebird 254 (FB254), a Eurocopter AS350, was assigned to the area encompassing Fire-CTAF 123.65 and was primarily focused on 2 fires west of Tenterfield – Frost Road (purple section in Figure 2) and Donnybrook State Forest (blue section in Figure 2). They were coordinating up to 14 aerial assets, including single engine air tankers (SEATs) and helicopters. 

Figure 2: Zoomed in map of active fires released at 1600 

Note: Fire mapping data was only provided at 4-hour intervals. There was no imagery provided for 1400. The above map was released at 1600; and was indicative of fire activity between 1400–1500 – the NSW RFS personnel on the ground were not aware of the extent of the fire at Christies. Source: NSW RFS annotated by the ATSB 

While not associated with the proximity events of the day, a second AAS was operating in a helicopter, callsign Firebird 279 (FB279), around 27 km north-east of Tenterfield at a fireground near Ogilvie (Figure 1). They were operating on the northern Fire-CTAF (118.65) coordinating 2 helicopters at the Ogilvie fire. That AAS later reported that they could not hear any radio transmissions being made later in the day, when aircraft were operating in the Jennings area, most likely due to terrain shielding. 

In the late morning and early afternoon, a forecast wind change occurred, and the fires to the west of Tenterfield made a faster than anticipated run towards the town and the airport. This increased the workload for personnel in the IMT, specifically the AOM, as there was a possibility that the Tenterfield air base, where major RFS assets were based, would come under threat from the fire. The AAS was also allocating assets to try to contain this fire to the west of the main highway. 

At 1329, during a teleconference[5] between the operations control centre in Sydney and the IC at Glen Innes, the IC advised there was a new fast‑moving grass fire in the Scrub Road area (red section in Figure 2) with 20–30 properties under threat. They advised they had one aircraft and 2 ground firefighting units but no other resources available to fight this fire. In response, the NSW RFS state operations controller (SOC) (see the section titledState operations controller) advised that one large air tanker (LAT),[6] already operational, could be diverted to the area. They also advised there was a possibility a second LAT could be made available, and that the IC could consider using those assets and reprioritising other assets already at the fire, if deemed necessary, which the IC noted.

Approximately 20 minutes later, without further consultation with the IC or personnel at the IMT, the SOC ordered the dispatch of 3 LATs – callsigns Bomber 210, Bomber 164 and Bomber 132, and a lead aircraft (Birddog 123)[7] to the Tenterfield area. The SOC advised the IC in a second conference call when discussing the Frost Road (purple section in Figure 2) and Donnybrook (blue section in Figure 2) fires that ‘we have 3 LATs that have been tasked to you in Tenterfield, and I understand the AAS  is liaising with the AOM in the IMT’. The IC did not conduct any further follow up with the AOM regarding the LATs.

The LATs and Birddog crews were (verbally) dispatched to the Scrub Road fire by the state air desk in Sydney and were provided with the southern area Fire-CTAF of 123.65. As the 2 adjacent Fire-CTAFs were not known to the state air desk, the LATs and Birddog crews were not advised of these. In addition, they were not provided with specific target information but were instructed to coordinate with the AAS in FB254 upon their arrival. The Birddog AAS reported that they were also not verbally informed that Bomber 132 had been tasked to the fire (although this was included in the tasking information, the tasking information could not be downloaded in flight). 

Shortly after, the state air desk operations manager (SADOM) sent a text message via mobile phone to the Glen Innes AOM advising that 3 LATs had been dispatched. However, the text message did not include an estimated time of arrival for the LATs or any intended targets. Although it was common practice for the AOM to pass details of arriving aircraft to the AAS, they could not specifically recall doing so, and the AAS in FB254 later reported being unaware that the LATs had been dispatched. 

Bomber 164 and Birddog 123 departed from Dubbo, NSW, and Bomber 210 departed from Coffs Harbour, NSW, at about the same time. During their flights, dispatch details were received, however due to the lack of internet reception at altitude, this could not be downloaded. About 30 minutes later, Bomber 132 departed from Richmond, NSW. The Birddog crew were in communication with the Bomber 164 crew on the NSW RFS assigned LAT frequency (130.55). Birddog 123 also communicated with Bomber 210 via the LAT CTAF[8] on Bomber 210’s arrival. 

Concurrently, the QFES was conducting firefighting operations at the ‘Christies’ fire. The NSW AOM and AAS were aware that these fires had been burning for several days and were aware QFES would be managing these fires. However, they had not considered the implications for their operations of aerial assets operating on the Queensland (Qld) side of the border.

At 1400,[9] the Christies fire started to threaten the Wallangarra/Jennings area on the border of Qld and NSW. QFES continued to refer to this fire as the ‘Christie’s’ fire, with NSW RFS referring to this fire as the ‘Jennings’ fire. Neither agency initially recognised that this was the same fire. Subsequently, QFES dispatched 6 aircraft, including a large air tanker,  to the border area. These aircraft were operating on a different QFES assigned Fire-CTAF, 122.65. 

There was no coordination between the NSW RFS and QFES regarding border operations at that time, and so NSW RFS personnel (SAD and the IMT) were unaware these aircraft had been dispatched. 

Birddog 123 arrived at the Scrub Road fire, broadcasting on the 123.65 Fire-CTAF, at around 1450. The Birddog AAS contacted the AAS in FB254, who, unaware that the birddog and LATs had been dispatched, was about to depart the Frost Road fireground to refuel. Prior to departing, they told the Birddog AAS they could head north of the Donnybrook fire, where a new fire had just started to develop and was running toward the Jennings township, and find a target. A review of flight data confirmed that FB254 was on the ground at Tenterfield Airport between 1454 and 1504.

Bomber 164 and Bomber 210 arrived around 7 minutes after the Birddog, which was about an hour after the AOM was advised via text message that they had been dispatched. The Birddog AAS advised the ATSB that to ensure separation with aircraft at the fireground, Bomber 164 and Bomber 210 were kept about 28 km to the west and south-west of the fireground, not lower than 6,000 ft above ground level (AGL). 

The FB254 AAS reported that, following refuelling at Tenterfield Airport, the helicopter was tasked to assist with a report of ground crews under threat from fire. A review of flight data confirmed that shortly after becoming airborne again, FB254 movements were consistent with a search and rescue pattern around 19 km south of the Scrub Road fire. While the AOM could not specifically recall tasking FB254 to assist the ground crews, they advised it was likely they had tasked them, as they were responsible for tasking aerial assets to respond to triple 0 calls or requests from ground crews. 

The Birddog AAS reported that they attempted contacting other aircraft in the area around the Scrub Road fire and made a couple of low runs with the intention of putting a retardant line to protect 2 properties on the southern edge of this fire. Once satisfied the area was suitable, they contacted the crew of Bomber 210, advising them to enter the area, and briefed them accordingly. However, the Birddog AAS reported that as Bomber 210 was on their final run to drop their retardant, they received a call from personnel within the IMT advising them not to drop the retardant and instead move further north towards Jennings to targets of higher priority. The ATSB could not verify when the Birddog was instructed to go north, or who issued that instruction. 

Neither the IMT personnel nor the FB245 AAS advised the Birddog AAS that the Jennings area was operating on a different Fire-CTAF. Therefore, when the Birddog and the LATs headed north towards Jennings, they remained on 123.65 instead of 118.65, which was being utilised by other aircraft in the Jennings area on the NSW side of the border (Figure 3).

Figure 3: Aerial traffic in the Tenterfield area at 1500

Image shows aircraft active in the specified area between 1455 and 1505. A 10-minute duration was used noting some only transmit positional information at a rate of 2 minutes, and with low level work some transmissions may not be captured. 5 aircraft were identified as being on an airfield (FB254 (AAS), Cessna 182 (private), HT297, HT468 and FB717). Source: NSW RFS map, data from ADSB and NAFC, annotated by the ATSB

Over the next hour, Bomber 210, Bomber 164 and Birddog 123 (operating on their discrete frequency) transited in and out of the northern Fire-CTAF 118.65, with the Birddog AAS also using the 123.65 Fire-CTAF. They also entered the Qld Fire-CTAF (122.65), unaware they were on a different frequency to other aircraft operating in this area. The LATs and Birddog crews reported multiple proximity events with other aircraft, citing other flight crews not communicating and not being visible on TCAS,[10] as the primary reasons for these events (see Transponder analysis).

Birddog 123 reported that they contacted the SAD multiple times on their mobile phone throughout the afternoon, advising of difficulty identifying and contacting aircraft in the area. In response, the SAD provided the Birddog with mobile telephone numbers for the pilots assigned to the fireground so that the Birddog could contact them directly. Confirmation of the Fire-CTAFs in use did not occur during these telephone calls. 

Personnel on the SAD had access to flight tracking software Tracplus,[11] which was used as a strategic situational awareness tool. It was not actively monitored and was not used to assess airspace congestion. Despite that, the SAD operations manager viewed Tracplus and noticed that the airspace appeared congested, and that Qld aircraft were operating in proximity to NSW RFS aircraft on the border. 

That observation prompted contact with the Qld SAD at 1525 (NSW time) to advise of NSW aerial operations taking place near the border. However, unaware of the northern Fire-CTAF in use, initially only Fire-CTAF 123.65 was relayed to the Qld SAD. In response, the Qld SAD advised the NSW SAD that Qld aircraft were operating on Fire‑CTAF 122.65. There was no evidence that that information was passed to any NSW RFS personnel at the firegrounds. 

Around 1530, Bomber 132 arrived at the fireground, and the crew contacted the Birddog 123 AAS. Until then, the Birddog AAS was unaware that the third LAT had been dispatched. There were no reports of proximity events involving Bomber 132 and it largely held at a higher altitude to the west of the fireground, due to having significant endurance and no specific targets allocated. 

At around 1600, the Glen Innes AOM advised the NSW SAD that there were 3 Fire‑CTAFs in use, and provided the specific frequencies.

Subsequently, the NSW SAD relayed that information to the Qld SAD, to enable QFES aircraft to coordinate with NSW RFS aircraft on 118.65. However, the Fire-CTAF information was not passed to the 3 LATs and Birddog already at the fireground. 

Shortly afterwards, while operating near Jennings, the pilot of Birddog 123 detected the QFES Birddog (125) on TCAS. By chance Birddog 125 was a company aircraft, and the 2 pilots knew each other personally. The pilot of Birddog 123 was therefore able to contact the other pilot by mobile telephone. During the subsequent discussion between them, it became clear that there were aerial assets, including LATs, operating at fires on either side of the border. 

The pilot of Birddog 123 reported that they subsequently advised the NSW RFS SAD that conditions were dangerous due to a lack of coordination and communication. Additionally, after the LATs completed their drops – one effective, one partially effective, and one ineffective – the Birddog AAS advised the NSW RFS LAT coordinator and SOC that they would not be returning to the fireground until communication issues were resolved.

This was not recognised as a task rejection (see the section titled Task rejection procedures) by either the large air tanker tasking coordinator (LATCO) or the SOC. As such, no records were made of the conversation and neither the LATCO nor the SOC took any action to ensure the communication concerns were addressed. Additionally, the safety concerns were not passed on to aircraft already at the fireground, nor the subsequent Birddog and LAT crew dispatched to the fire approximately one hour later.  

Context

Personnel from multiple agencies were involved in the firefighting operations in the Tenterfield area on 31 October 2023. These included the New South Wales (NSW) Rural Fire Service (RFS), NSW National Parks and Wildlife Service and pilots and air crew of various aircraft operators contracted to NSW RFS. Later in the afternoon, as fires on the Queensland side of the border converged with fires in NSW, personnel from Queensland Fire and Emergency Services (QFES) were also involved. 

New South Wales Rural Fire Service

The NSW RFS was the lead agency for fighting bushfires in NSW. They worked closely with other agencies to respond to a range of emergencies, including:

• bush and grass fires
• bushfire mitigation
• structure fires
• search and rescue (SAR)
• motor vehicle accidents
• storm response in rural districts.

The RFS was primarily made up of volunteers, with paid staff members managing day‑to‑day operations, incident management teams (IMTs) and operational support, among other roles. There were many roles involved in the RFS emergency management response; for clarity, only those roles applicable on the day are discussed below.

State operations centre

When required, the multi-agency, statewide response to large bushfire emergencies was overseen and coordinated by the state operations centre, located at NSW RFS headquarters in Sydney. 

State operations controller

The state operations controller (SOC), located in the state operations centre, maintained overall command of the firefighting effort across the state, and allocated resources as needed.

State air desk

The state operations centre also contained the state air desk (SAD), which was the state level multi-agency team responsible for coordination of aircraft operations. When activated, the SAD provided ‘advice, dispatch services and logistical support in response to a request for aviation resource/s in accordance with available information and contractual arrangements’. The 2 key positions for aerial assets were the: 

• state air desk operations manager (SADOM), who was responsible for ensuring that aircraft and aviation support resources were dispatched and coordinated to incidents. The SADOM was to maintain ‘a strategic overview to ensure the safe, effective and efficient management of aerial and logistical support assets’.
• large air tanker tasking coordinator (LATCO) who coordinated ‘the tasking of LAT resources on days of heightened fire danger/activity in consultation with the state operations controller’.

The NSW RFS advised that the scale of activity on 31 October 2023 placed the NSW RFS State Operations Centre and SAD under significant pressure. 

Personnel in the State Operations Centre were required to manage high levels of incident reporting, resourcing requests, and inter-agency coordination across 6 concurrent Section 44 declarations. This included prioritising the movement of out‑of‑area strike teams, coordinating logistics for remote firegrounds and supporting Incident Management Teams (IMTs) that were themselves under strain. 

The SAD also faced exceptional demand as numerous firegrounds across northern NSW required aviation support simultaneously.

Incident management team

The coordination and management of a regional response to fires and other incidents was undertaken through an IMT located in proximity to the fires. The IMT for the fires in the Tenterfield area on the day was established at Glen Innes, NSW. Personnel at the IMT were responsible for management of all firefighting activities including:

• answering triple 0 fire calls for the area and deploying assets to respond to those calls
• coordinating ground crews
• coordinating aerial assets
• managing all logistics for aerial and ground crews, including fuel, food and breaks. 

Incident controller

At the IMT, the incident controller (IC) had overall command of all ground and aerial firefighting activities in their allocated region. 

The Glen Innes IC’s intent on the day, outlined in an incident action plan,[12] was to hold fires within proposed containment lines, monitor fire progression and protect assets on the eastern and southern sides of the fire. The IMT was managing 10 separate fires in the Tenterfield area on 31 October 2023.

Air operations manager

The IC relied on the air operations manager (AOM) to coordinate all aerial activities, as the AOM had more specific training in aerial firefighting. NSW RFS procedures stated that an: 

AOM shall be activated during a major incident and/or when five or more aircraft are required in relation to an incident.

The incident AOM advised that they worked closely with the air attack supervisor (AAS), located overhead the fireground, to ensure they had enough resources, and to ensure the employed strategy was working. During interviews after the event, both the AOM and AAS stated that they had sufficient aerial assets on the day to fight the fires, and the addition of LATs did not assist the task.

The AOM assessed that due to the:

• fire complexity
• number of aviation assets dispatched to the region
• available resources in the centre

they ‘were completely task saturated on the day’. 

The AOM had been involved in firefighting for over 20 years and, after obtaining extensive experience in many different areas, had trained and qualified in the AOM role in 2018. They advised this was one of the busiest shifts they had encountered. The SADOM later reported that the IMT was ‘certainly busy’, and in hindsight ‘we should have got them more resources’. 

Air attack supervisor

The AAS was a tactical command position, controlling the overall firefighting strategy for aircraft at a fireground. They ensured that aerial operations were consistent with procedures and the incident action plan. This included maintaining communications and providing intelligence about the fires to relevant IMT personnel and organising aircraft at the fireground. NSW RFS procedures stated ‘an AAS should be considered where there were 2 or more aircraft’ and was required ‘when there are 3 or more aircraft operating on the one incident’. 

While all aircraft assigned to a fireground were ultimately responsible for their own separation, using ‘see‑and‑avoid’ principles, the AAS was required to: 

brief pilots, in the air and on the ground, on specific assignments including identification of ground personnel, hazards, tactical information, and communication links; and to ensure safety standards were maintained at all times. 

On the incident day, the number and mix of helicopters, small and large aeroplanes and the convergence of different fire fronts presented a complex aerial firefighting operation. 

The AAS in FB254 was managing:

• Donnybrook fire – 4 single engine air tanker (SEATs) aeroplanes – 3 of which were floatplanes collecting water from a nearby lake and 1 returning to Tenterfield for loading, along with 1 firebombing helicopter
• Frost Road fire – several firebombing helicopters working with ground crews
• south-east of Tenterfield – 2 helicopters collecting intelligence on the fire conditions. 

These aircraft were geographically separated and, where applicable, a stack was applied, with:

• established exit and entry points so that all aircraft working on a fire were operating in the same direction
• entry and exit lanes at different altitudes
• standard radio communication procedures to ensure separation
• different aircraft types assigned different altitudes.

The AAS had extensive firefighting experience and had been performing the AAS role for around 23 years. The AAS self-assessed that they were not overloaded, stating that while it was busy, they were not at saturation point and it was not the worst fireground they had experienced. The AOM also assessed that the AAS was managing their workload well and no evidence was identified that the AAS lost situation awareness. Further, there were no reports of any communication or separation issues prior to the arrival of the LATs. 

Operational procedures

The RFS maintained a suite of documents, which detailed the procedures for managing aerial firefighting. The 2 primary documents for air tanker operations were the:

• interagency aviation standard operating procedures, which outlined the basic procedure for all air tanker operations
• NSW RFS operating guidelines for air tanker operations (operating guidelines), which provided further details specifically for the LAT program.

Additional procedures and forms were contained in the operational management procedures, incident management procedures and the air attack supervisor manual.

Aerial supervision

Supervision continuity

The NSW RFS procedures contained no information on ensuring continuity of the AAS role when the AAS was required to depart the fireground for rest or to refuel. The AAS, and others interviewed, described that if the AAS was required to depart, they would leave aircraft strategically separated, and they would also ask a senior pilot to ‘keep an eye on things’ while they were gone. 

The United States Department of Agriculture (US Forest Service) advised the ATSB that, while not documented, where an AAS needed to depart (for fuel or a scheduled rest break), a replacement AAS would be pre-arranged to ensure an adequate handover. If no replacement was available, they would reduce either the complexity of the aerial firefighting strategy, or the number of aircraft at the fireground. 

Number of aircraft under supervision

The NSW RFS procedures also contained no information on a maximum number of aircraft to be controlled by one AAS nor information on specific trigger points on when to review the ongoing supervision arrangements. 

The US National Wildfire Coordinating Group document, Standards for Aerial Supervision, stated: 

There is no way to define an exact trigger point for adjusting, downsizing, or completely suspending aviation operations. The factors listed below should be evaluated to determine whether additional Aerial Supervision resources are needed or tactical/logistical missions need to be modified/suspended.

• Complexity of aviation operations
• Communications
• Topography
• Firefighter and public safety
• Poor visibility
• Wind/turbulence
• Fire behaviour
• Aircraft performance
• Aircraft incident/accident.

NSW RFS released a memo after this fire activity, which stated: 

the SAD is to liaise regularly with the Air Operations Manager (AOM) and AAS responsible for 3 or more aircraft to confirm aerial supervision arrangements remain appropriate. In particular, consideration should be given to the allocation of additional AAS platforms' taking into account: 

• the number of aircraft tasked
• the number of fires burning and their proximity to each other 
• size of the area of operations 
• other complexities such environmental factors (e.g. weather, visibility).

Birddog operation

When LATs were dispatched to a fire, they would generally be accompanied by a separate birddog aircraft. In those circumstances, a LAT air attack supervisor (LAT AAS) in the birddog aircraft coordinated the LAT movement with the incident AAS. Their role included briefing the LAT crew on the specific assignment, identifying hazards, tactics and managing communications with the incident AAS. 

The NSW RFS air tanker guidelines indicated that an incident AAS was pivotal to LAT operations, stating: 

the Incident AAS is to ensure all incident aircraft are advised of the proposed air tanker mission and agreed airspace and communication arrangements are established.

Prior to the Birddog arriving over the fire, the Incident AAS will identify and assign an altitude following discussion with the Birddog.

The Incident AAS aircraft will orbit at this level and operate as a communication link between the ground crews and Birddog while maintaining a strategic overview and coverage of the operation. 

This will allow the Birddog aircraft to focus on mission objectives and coordinating the air tanker(s).

The guidelines further stated that: 

When an Incident AAS is not established at an Incident, the LAT AAS will assume the Incident AAS roles and responsibilities.

The RFS advised that this model adapted supervisory functions to available resources, fleet composition, and the dynamic nature of domestic fireground operations.

In contrast, the Western Australia (Department of Fire and Emergency Services) LAT guidelines stated that: 

In the absence of a Primary AAS during fuel cycles, etc. the BDOG [birddog] AAS is not permitted to undertake duties conducted by the Primary AAS. An arriving LAT shall not enter the stack or the ‘holding area’ until permission is given by the Primary AAS PIC.

Large air tanker dispatch approval procedures

The NSW inter-agency aviation standard operating procedures noted that air tankers could provide large volumes of suppressant, and careful planning and supervision was needed to ensure this was used effectively. 

The NSW RFS air tanker guidelines stated that for a LAT and/or birddog to be dispatched, an aircraft request form from the incident controller (IC) was required, outlining a strategy in conjunction with the SAD who could provide ‘guidance on availability and suitability’. The request was then subject to approval by the state operations controller (SOC).

When considering tasking air tankers, the operating procedures stated the IC and SOC were to consider the following:

• incident objectives
• threats (life/property, assets, forests) 
• terrain and fuel types (forest/grassland/urban interface)
• prevailing and/or forecast weather and flying conditions, including turbulence & visibility
• effectiveness of alternate capacity aircraft and/or ground units 
• elapsed time for aircraft to arrive ‘on site’ 
• time of day (last light); and 
• suppressant / retardant quantity required.

Following SOC approval, the SAD would advise the LAT airbase manager of the approval and mission objectives.

According to the NSW RFS operational management procedure ‘dispatch of aviation resources’:

Any dispatch of aviation resources must always be supported by an appropriately approved aircraft/aviation equipment request form. 

The operational management procedures further noted that:

It is acknowledged that the tasking of aviation resources can have a range of specific requirements not covered directly in this tasking procedure. In the event the SAOM [state air desk operations manager] or the SDAO [state duty aviation officer] believes there is valid reason to initiate dispatch outside of these guidelines (including dispatching a different resource to what was requested, or a compelling reason to dispatch another aircraft in addition to the area contract aircraft), they must first contact the State Duty Operations Officer (SDOO), State Operations Controller (SOC) or Manager aviation and advise the reasons for operating outside of the guidelines and gain approval for this variation BEFORE the dispatch is allocated. 

The reasons and approval for dispatch outside of these guidelines should be documented within the ‘decision notes’ area of the air desk dispatch module in ARENA.[13]

NSW RFS later advised that: 

No decision notes were kept in ARENA, if the aircraft were directed to attend by the SDOO or SOC this was captured in the Air Tanker Dispatch form and SAD/SOC log books.

In response to the draft report, NSW RFS advised the ATSB that:

RFS doctrine explicitly provided the SOC and State Duty Operations Officer discretion to deploy aircraft outside the standard request workflow in rapidly escalating situations or where there was an immediate threat to life or property.

In addition, it advised:

that SOC-initiated tasking on the day was consistent with approved doctrine and that the absence of formalised integration triggers reflected procedural maturity at the time, not non-compliance. 

Since the occurrence, NSW RFS has strengthened integration processes through revised Standard Operating Procedures (SOPs) and targeted training. These changes explicitly address the interface between SOC-initiated tasking and IMT coordination, ensuring that Large Air Tanker (LAT) tasking is both procedurally supported and operationally integrated.

Large aircraft tanker tasking on 31 October 2023

On the incident morning, the IMT requested one LAT with a birddog to assist with fire suppression. The request form was completed by the AOM, with the form detailing:

• the specific target intended for the LAT
• the entry and exit paths mapped out
• appropriate Fire-CTAF. 

This request was approved by the SOC. The LAT arrived at the fireground a short time later and after discussions with the AAS around drop sites, successfully completed a drop. 

Later that afternoon, a decision to task 3 additional LATs was made by the SOC and relayed to the Glen Innes IC during the 1352 conference call discussing the fire situation in the Tenterfield area with senior personnel from the State Operations Centre. However, the ARENA dispatch form for all 3 LATS listed the AOM as the requesting officer. 

The incident controller, air operations manager, air attack supervisor, state air desk operations manager and large air tanker coordinator logbooks were provided to the ATSB, none of which detailed the decision to send the 3 LATs on 31 October 2023. 

The SOC did not maintain an operational logbook for 30 and 31 October 2023. They recorded some notes in their personal notebook, however, they were not of sufficient detail for the SOC to later recall key events or decisions made on 31 October 2023, including the rationale for dispatching 3 unrequested LATs to the Tenterfield area.

In response to the draft report the NSW RFS advised the ATSB that: 

The NSW RFS Operational Management Procedure – State Operations Controller (OMP) in force at that time, did not impose a universal requirement for all senior personnel to maintain a formal operational logbook. Rather, it required that the SOC was ‘responsible for ensuring a record is maintained of significant decisions taken, the rationale for those decisions, and to whom, when and how they were communicated.’

In addition, the recorded emergency conference calls constitute an important complementary record. These recordings capture significant decisions, the rationale underpinning them, and the details of communication including who was informed, when, and how. Taken together, the SOC’s notebook and the conference-call recordings demonstrate compliance with the OMP requirement to maintain a record of significant decisions, even if that record was not in the form of a formal logbook.

While recorded conference calls did provide operational context and captured significant decisions, the rationale for the dispatch of 3 LATs remained unclear. The LAT dispatch forms also did not capture any decision-making notes. 

Additionally, the dispatch form, received by the birddog AAS after departure, did not contain detail of specific target/s or information on the 3 Fire-CTAFs in use. It also had incomplete detail of the known aircraft already operating in the area (the intelligence gathering aircraft were not identified). At the time, there was no documented requirement for flight crew to wait for a dispatch form prior to departure.

Despite the IC not requesting the LATs, no personnel from the SAD, the IMT or the fireground queried the LATs dispatch. Multiple personnel interviewed stated that LATs were often dispatched by the SAD without a request from the fireground. Those personnel further stated that dispatch in that manner was often a hindrance as the LATs did not have specific targets, and the incident plan was regularly disrupted to accommodate them, which reduced overall firefighting effectiveness. 

In this instance:

• B164 ‘dropped wherever they could as they were running out of fuel’
• B210 departed for Coffs Harbour after completing a partially effective drop retardant
• B132 ‘completed an effective drop’ before returning to Richmond.

Task rejection procedures

The NSW RFS task rejection procedure provided guidance for the rejection of an aviation dispatch/tasking as follows:

Flight crew or operators may reject an aviation tasking when:

• there is a violation of regulated safe aviation practices;
• weather and environmental conditions make the activity unsafe;
• there is insufficient information to safely plan or undertake the activity; or
• they lack the necessary qualification or experience.

There is an obligation on individuals to ensure any concerns or a decision to reject a tasking are notified as soon as possible. 

Equally, there is an obligation on an IMT and/or SAD to ensure all aircraft and operators assigned to a particular incident are advised of any tasking rejection as soon as possible. 

The NSW RFS held a task rejection register, which had 19 task rejections recorded for 2023. 

When interviewed 12 months after the Tenterfield fires, neither the LATCO nor SOC could recall specific details of the call with the AAS in Birddog 123, in which they reported voicing safety concerns about coordination and communication. However, at the time neither recognised the concerns raised as a task rejection. They further reported that they needed to hear the words ‘task rejection’ from crew before actioning the task rejection procedures.

The SAD operations manager stated that in hindsight it was probably not recognised because no one said, ‘I task reject this’ and that ‘we should have paused and taken it as a task rejection’. Additionally, the SOC advised that it was the first or second season after the task rejection arrangements had been implemented, and that improvements were probably required to ensure that task rejections were more explicit.

Other NSW RFS personnel advised that crew relaying safety concerns would prompt them to ask the crew if they were rejecting a task. Another LATCO, who was not on shift that day, reported that if a crew advised they were not returning to a fireground due to safety concerns, that would prompt them to action the task rejection process. 

In addition to the Birddog’s concerns, the B210 crew reported that on return to their base at Coffs Harbour, they advised the SAD that their intentions were not to return to the fire until the communications problems were resolved. The LATCO reported being unaware of that, and there were no records in any logbooks or ICON[14] of that conversation.

At about 1800 on 31 October 2023, B210 was re-tasked back to the fireground with a different birddog. Recorded calls to the SAD confirmed that B210 sought clarification from the SAD that communication issues have been resolved. When the SAD operator advised that they did not know, B210 advised the operator that ‘we had to shut it down because too many aircraft were not communicating’. They reported advising the SAD that they would load but remain on the ground until they received confirmation from their birddog, when they arrived at the fireground, that the operation was safe to continue.

Following the occurrence, the NSW RFS sent a memo to all operators reminding them to raise any risks or concerns and to reject an aviation tasking if they felt it necessary. 

Airspace procedures

Fire common traffic advisory frequencies

On the evening prior to the incident, anticipating significant aerial assets, the AOM based at the Glen Innes IMT requested, and was issued, 2 additional fire common traffic advisory frequencies (Fire-CTAFs) to the earlier assigned 123.65 by the SAD (Figure 1). While there was likely a verbal handover between SAD shift personnel following the frequency allocation, it was not possible to determine what information was shared.

There was also no requirement for a map of the Fire-CTAF divisions to be recorded or displayed at the SAD, although it was reported that this had occurred on previous occasions. Personnel manning the SAD on 31 October 2023 had no visual representation of the Fire-CTAF divisions and assumed the only Fire-CTAF in use in the Tenterfield area was the southern Fire-CTAF 123.65. 

In addition, aircraft request and aircraft dispatch forms only prompted one Fire-CTAF to be recorded.

Temporary restricted area 

To prevent aircraft entering airspace associated with an active fireground, a temporary restricted area (TRA) could be requested through the Civil Aviation Safety Authority’s (CASA) Office of Airspace Regulation. NSW RFS had a 24/7 contact number for CASA to facilitate such a request. 

The NSW RFS interagency aviation standard operating procedures stated that:

ICs may require additional airspace restrictions or provide additional NOTAM advice to pilots during incident operations. This requirement may be due to complex incident operations, working environment, level of activity or interference from other traffic. The IC/OIC is required to contact the SAD [state air desk] or the hiring agency to seek advice.

The emergency services inter-agency standard operating procedures stated that:

Airservices Australia (ASA) provide a Temporary Flight Restriction (TFR) for bush fires on Area Forecasts specifying non fire traffic to remain clear at a five (5) nautical mile radius and not below 3,000 feet above ground level (AGL) of observed fires.

However, CASA advised that the emergency services inter-agency standard operating procedure was outdated, and, although published in the Airservices Australia (Airservices) Aeronautical Information Publication (AIP), was advisory only, and there was no requirement for aircraft to remain clear of bushfires unless a TRA had been implemented. 

NSW RFS had no further guidelines or procedures in place regarding when a TRA should be implemented, or who was responsible for implementing one. The NSW RFS did not request a TRA for the Tenterfield area on 31 October 2023. 

Wake turbulence separation 

Wake turbulence[15] is produced by heavy aircraft with the most turbulent air being produced by aircraft flying slowly at high angles of attack, which is typical of a LAT during a fire-retardant drop. Wake turbulence can result in a dangerous situation for smaller aircraft flying directly into a larger aircraft’s wake. 

NSW RFS had no minimum wake turbulence separation (time or distance) requirement in its procedures, and the responsibility for separating LATs with other aircraft operating at the fireground was assigned to the Birddog crew (LAT AAS). 

According to the NSW RFS LAT guidelines:

The Birddog is to establish flight paths to avoid creating hazards to other aircraft at the fire and drop zone along with persons or property on the ground with consideration to potential wake turbulence created by the air tanker.

The United States Forestry Service (USFS), which oversees extensive aerial firefighting operations across the US, has a minimum wake turbulence separation of 2 minutes when very large air tankers (VLATs) are operating, but there was no minimum separation standard when LATs are operating. 

While not specifically a wake turbulence procedure, the WA aerial fire suppression procedures always required a 5 NM (9 km) separation between LATs and other aircraft:

All firebombing aircraft shall be cleared from the sector prior to the LAT entering the stack from its 5 NM holding position at a pre-determined nominal entry level of not above 1,500 ft [above ground level] AGL.

There must be a minimum horizontal separation of 5 NM from:

• the sector the LAT is operating in

• all other aircraft operating below 2,500 ft AGL.

The ATSB notes that procedures from other jurisdictions are shaped by their own operating context and may not be directly transferable or suitable for the NSW operational environment.

Cross-border procedures

Queensland Fire and Emergency Service (QFES) had a similar command structure to NSW RFS. On the incident day, the state operations centre, including a SAD was established in Brisbane. Similar to the incident management teams established by NSW RFS, QFES established a regional operations centre (ROC) to oversee the Wallangarra fire,[16] at Charlton, Qld. An incident AAS was in a helicopter over the fireground at Wallangarra supervising QFES aerial assets at the fire on the Queensland side of the border.      

There were no documented procedures for either QFES or NSW RFS for cross‑border fires regarding aviation assets. However, NSW RFS had established cross‑border arrangements in place with both Victoria and the Australian Capital Territory. 

On the day, at around 1525 (NSW time), the NSW SAD advised the Qld SAD of 3 LATs inbound to Jennings. The Qld SAD advised NSW of the Qld 122.65 Fire-CTAF in use. It could not be ascertained why this information was not provided to the 3 NSW LATs and Birddog.

At 1555 (NSW time), the NSW SAD advised the Qld SAD of the NSW 123.65 Fire-CTAF which was passed to the Qld incident controller. About 15 minutes later, the Qld SAD received updated advice from the NSW SAD that the correct frequency for the area was 118.65. 

Recorded data

The ATSB sourced flight track data between 0800–1800 on 31 October 2023, based on geographic location, as in the area outlined in red in Figure 4. The reviewed data included information sourced[17] from:

• Airservices Australia (ASA)
• Radar data (primary and secondary surveillance)
• ADS-B[18] data and
• National Aerial Firefighting Centre (NAFC) ARENA[19] recordings.

Figure 4: ATSB data search area

The red border outlines the area assessed. The Qld/NSW border is marked in orange. Source: ATSB

The ASA-processed radar data provided positional information at 5‑second intervals. Where available, the ADS-B data was generally captured at 1‑second or better intervals. The NAFC data, which could be transmitted at any selected interval, with an interval no greater than 120 seconds, varied between 15 seconds and 120 seconds. Data from all sources was combined for the analysis.

Identification of proximity events

Where data was not captured at 1‑ second intervals, positional data was interpolated, based on great circle arcs between recorded points. This allowed for determination of approach points between aircraft, noting that where gaps are large (up to 2 minutes for the 19 NAFC only dataset) and aircraft are manoeuvring, these paths may not accurately reflect aircraft movement. Distances between aircraft at each point were then calculated using the same method.

The data review identified 205 instances of unique pairs of aircraft operating within 1,000 m of each other over the reviewed period. This was indicative of the nature of aerial firefighting operations, where aircraft are typically managed through established altitude, lateral, and time-separation procedures. As such, proximity alone does not indicate an elevated collision risk.

Limitations of the data for aircraft operating at low levels meant there may have been more instances where aircraft were in close proximity to each other which were not captured.

Of the 4 reported incidents reviewed, 2 were positively identified in the data analysis. The third event could not be identified, however, potentially involved a private aircraft without an active transponder. Analysis of the available data for the fourth event identified a few potential conflicts, but due to data limitations could not positively identify the aircraft involved.

Transponder analysis

Reporters raised concerns that firefighting helicopters had transponders turned off. An analysis was conducted of the 52 aircraft with active transponders (either in the ADS-B or NAFC data set), to determine the time elapsed between received data points, and identify periods of missing data greater than 5 minutes. The ATSB reviewed the data and could find no evidence of any firefighting helicopters turning transponders off during flight. (For further information on the data review see Appendix.)

Safety analysis

Introduction

In the days leading up to 31 October 2023, extreme fire weather,[20] critically dry fuels and multiple simultaneous fire escalations combined across the Tenterfield, Inverell, and Glen Innes Severn Local Government Areas (LGAs). The NSW Rural Fire Service (NSW RFS) advised this created one of the most challenging operational environments encountered during the 2023 fire season.

On 31 October 2023, the Tenterfield LGA recorded 10 active fires, many of which escalated during the afternoon under the influence of strong winds. Up to 17 New South Wales (NSW) Rural Fire Service (RFS) aircraft were deployed in the Tenterfield area in support of firefighting activities. The aircraft had been separated geographically and by different operating altitudes, and there were also 3 separate fire common traffic advisory frequencies (Fire-CTAFs) in use. While the airspace was busy, the involved air attack supervisor (AAS) reported that the activity was manageable, and there were no reported aircraft separation or communication/coordination issues. 

In the early afternoon, a birddog aircraft and 3 large air tankers (LATs) were dispatched to the Tenterfield area, with incomplete operational information provided to both the involved crews and the receiving personnel. That led to the LATs and birddog arriving unexpectedly and transiting through the busy airspace on incorrect frequencies, resulting in multiple communication issues with other aircraft. 

This analysis will examine the safety risks associated with the deployment of the LATs, together with airspace issues and state cross‑border coordination. 

Large air tanker dispatch 

Operational coordination

The state operations controller (SOC) ordered the dispatch of the birddog aircraft and 3 large air tankers (LATs) to the Tenterfield area without consultation with the incident management team (including the air operations manager (AOM)) on how the LATs would be effectively integrated into the existing incident plan. While there were provisions for the SOC to instigate the dispatch of the LATs, this bypassed the normal provision of operational tasking information and resulted in the LATs being dispatched without specific targets or correct airspace information. Additionally, their specific arrival time was unknown by the receiving personnel.

Incident plan integration

While NSW RFS had documented procedures outlining the process when the incident management teams (IMTs) requested a LAT, there was no documented procedure specifying what communication and coordination needed to occur when the state air desk (SAD) proactively dispatched a LAT/s. 

On the day, this resulted in the LATs being dispatched with no consideration for how they would be incorporated into the already established incident plan at the fireground/s and no clear consideration of their intended target/s. There was also no apparent consideration of whether the incident AAS had capacity to incorporate the LATs when they arrived. In this instance the AAS was required to depart the fireground to refuel as the LATs arrived.

While acknowledging that the SAD has a greater understanding of available aircraft resources across the state during an emergency than local IMTs do, procedures requiring coordination with the IMT prior to dispatch ensures that:

• the incident AAS is on scene and has capacity to coordinate the LATs when they arrive
• there is a suitable plan to utilise the LATs when they arrive at a fireground
• LAT crews have all the required operational information.

Fire common traffic advisory frequency usage

Despite the fire common traffic advisory frequencies (Fire-CTAFs) being allocated by the state air desk the evening prior, personnel on the state air desk were not aware that there were 3 Fire‑CTAFs in use on 31 October 2023.

While it was normal practice to display a pictorial map of Fire-CTAF boundaries at the state air desk, there was no documented requirement to do so. This resulted in the 3 LATs and their birddog being dispatched with incomplete airspace information provided to their crews.

Fireground communication

While the AOM was aware that LATs had been dispatched around 60 minutes prior to their arrival, they had not been made aware of the LATs’ anticipated arrival time or intended target/s. It is possible that due to their workload on a day of high fire complexity, they did not pass what they knew of the LAT tasking to the incident AAS. 

Shortly after the Birddog and LATs arrived at the fireground, the AAS was required to depart the fireground to refuel and then tasked by the AOM to a search and rescue task around 19 km south of the Scrub Road fireground. This meant that while there was an AAS in the birddog aircraft, there was no supervision of the remaining aircraft at the fireground following the arrival of the LATs.

The incident AAS was not aware that the LATs had been dispatched and was about to depart the fireground to refuel when they arrived. As such, they had no opportunity to plan and coordinate the LATs’ arrival. 

Prior to departing, the AAS did not provide the birddog crew with an overview of the known traffic situation. In addition, while it was reasonable that they assumed that LAT and birddog crews had been informed of the multiple Fire-CTAFs in operation, this was a missed opportunity for that information to be passed on. 

Aerial supervision

NSW RFS required an incident AAS to be in place when 3 or more aircraft were operating at a fireground. However, an AAS would have to leave the fireground for scheduled rest breaks or, as on the day, to refuel, and there was no documented procedure for consideration of ongoing supervision when this occurred. On the day, this resulted in no AAS being made available to replace the incident AAS when they were required to depart the fireground. 

There was a provision in the NSW RFS large air tanker (LAT) guidelines for the LAT AAS in the birddog aircraft to assume the incident AAS role in the absence of an incident AAS, but there was no guidance or procedure to assess their capacity to do so. On the day, there was no evidence that the LAT AAS was expected to take over the incident AAS role and it was unlikely they would have had capacity to do so, while already coordinating 3 LATs.

Additionally, there was no consideration or trigger points for increasing the number of supervisors when the number of aircraft increased at a fireground or when the complexity of fire activity increased. Although the NSW RFS ground firefighting span of control principle was that no more than 8 assets should be under one individual’s control, similar limits were not applied to aerial operations. As such, the NSW RFS had no documented means of ensuring there was adequate supervision when aerial assets were operating.

Task rejection

The birddog crew reported having numerous conversations with the state air desk relaying concerns around communication issues and congested airspace including advising that the conditions were ‘dangerous’. LAT Bomber 210 also reported advising the state air desk they would not be returning to the fireground until communication issues were resolved. Neither of these conversations were recognised by the state air desk as task rejections and, as such, the task rejection procedures were not implemented. However, on the day, this did not have an adverse effect on the replacement birddog and LAT, as by the time they were re-tasked, the traffic levels had reduced and the state air desk had information on the Fire-CTAFs. 

Both the LAT tasking coordinator (LATCO) and SOC stated in interview that unless the term ‘task rejection’ was specifically stated, they did not necessarily action the procedure, which was inconsistent with the understanding of other senior state air desk personnel interviewed. This indicated an under appreciation of the importance of the procedure by senior management at the NSW RFS. 

The NSW RFS task rejection register verified that the task rejection procedure had previously been followed multiple times, indicating that state air desk personnel were aware of, understood, and actioned this procedure. 

As previously identified in ATSB investigation AO-2020-007 (Collision with terrain involving Lockheed Martin EC-130Q, N134CG 50 km north-east of Cooma-Snowy Mountains Airport (near Peak View), New South Wales, on 23 January 2020), communication of identified unsafe conditions to other operating crews and to personnel on the state air desk is critically important to ensure everyone has the same situation awareness, and that this information can be factored into flight crews and state air desk personnel’s decision‑making process and risk assessments.

Temporary restricted area

The NSW RFS did not have a procedure for implementing a temporary restricted area (TRA), including a trigger for when one should be implemented. As a result, despite anticipating multiple firefighting aircraft in the area, neither the state air desk nor personnel in the IMT considered implementing one on the day. The ATSB review of flight data identified that 27 non-essential aircraft transited through the Fire-CTAFs, with no way of verbally communicating with firefighting aircraft. Of these aircraft, 8 were also not transmitting a secondary surveillance radar output, so were not visible on firefighting aircraft’s traffic avoidance systems.

Wake turbulence

While NSW RFS procedures considered wake turbulence separation between lighter aircraft from LATs, it relied on the incident or birddog AAS to provide separation between the LATs to other aircraft. However, the procedures did not require an incident AAS to always be present. 

When large air tankers are completing drops, their configuration creates significant wake turbulence and aircraft within the wake turbulence zone may be subject to a loss of control in flight. Given these operations almost always occur at low level, there is an increased risk that there may not be sufficient altitude for affected aircraft to recover. 

Cross-border coordination

Queensland Fire and Emergency Service (QFES) and the NSW Rural Fire Service (RFS) did not have documented procedures for how aircraft from both states would conduct joint cross-border firefighting. As a result, while there were some discussions at the state air desk level once the concerns were identified, NSW RFS and QFES aerial assets initially operated in proximity without any coordination, and on different radio frequencies.

On the day, the NSW RFS state air desk and the Glenn Innes IMT were aware of fires on the Qld border and, at some point, both QFES and NSW RFS were also aware of each other’s aerial assets. However, initially neither agency considered that aerial assets on either side of the border may conflict. 

Findings

From the evidence available, the following findings are made with respect to the coordination and communication breakdown during aerial firefighting operations near Tenterfield, New South Wales, on 31 October 2023:

Contributing factors

• Three large air tankers (LATs) were tasked to the Tenterfield fireground by the state operations controller without consultation with the incident management team. That resulted in the LATs being dispatched without targets or correct airspace information and receiving personnel being unaware of their arrival time.
• The New South Wales Rural Fire Service did not have a procedure for ensuring that when large air tankers were dispatched by the state air desk their tasking was coordinated with the incident management team and integrated into the existing incident plan. (Safety issue)
• The New South Wales Rural Fire Service had no procedure to ensure that fire common traffic advisory frequencies (Fire-CTAFs) were reliably known by state air desk personnel. This resulted in aircraft being dispatched with incomplete Fire-CTAF information. (Safety issue)
• Possibly due to their workload, the air operations manager likely did not pass what they knew of the large air tanker tasking to the incident air attack supervisor (AAS) and subsequently tasked the AAS away from the fireground on an emergency task.
• Due in part to the air attack supervisor (AAS) not expecting the large air tankers, and being unaware they had incomplete dispatch information, the AAS did not provide traffic or Fire-CTAF information to the birddog AAS prior to departing the fireground.
• Despite a New South Wales Rural Fire Service requirement for an air attack supervisor (AAS) to be in place when 3 or more aircraft were operating, when the AAS was required to depart the fireground there was no planned replacement AAS to supervise the multiple aircraft in the area.
• The New South Wales Rural Fire Services procedures required an air attack supervisor (AAS) when 3 or more aircraft were deployed to a fireground. However, there was:
• no assurance aerial supervision would remain adequate as aircraft numbers and/or fire complexity increased
• inadequate guidance for consideration of suitable supervision when the AAS was required to depart the fireground. (Safety issue)
• Neither the New South Wales Rural Fire Service or Queensland Fire and Emergency Service had established cross-border coordination procedures for aerial firefighting activities to ensure reliable aircraft communication and separation. (Safety issue)

Other factors that increased risk

• There was an inconsistent understanding within New South Wales Rural Fire Service State Air Desk of the threshold required to action task rejection procedures. Consequently, reports of unsafe conditions on the fireground were not promptly actioned. (Safety issue)
• The New South Wales Rural Fire Service did not have a procedure to implement a temporary restricted area to reduce the risk of an air proximity event with aircraft not associated with firefighting operations. (Safety issue)
• The New South Wales Rural Fire Service did not have an effective means to manage wake turbulence separation for aircraft operating in the vicinity of the large air tankers, increasing the risk of an unrecoverable loss of aircraft control. (Safety issue)

Safety issues and actions

Incident plan large air tanker integration

Safety issue number: AO-2023-054-SI-01

Safety issue description: The New South Wales Rural Fire Service did not have a procedure for ensuring that when large air tankers were dispatched by the state air desk their tasking was coordinated with the incident management team and integrated into the existing incident plan.

Fire common traffic area frequency usage

Safety issue number: AO-2023-054-SI-02

Safety issue description: The New South Wales Rural Fire Service had no procedure to ensure that fire common traffic advisory frequencies (Fire-CTAFs) were reliably known by state air desk personnel. This resulted in aircraft being dispatched with incomplete Fire-CTAF information.

Aerial supervision

Safety issue number: AO-2023-054-SI-03

Safety issue description: The New South Wales Rural Fire Services procedures required an air attack supervisor (AAS) when 3 or more aircraft were deployed to a fireground. However, there was:

• no assurance aerial supervision would remain adequate as aircraft numbers and/or fire complexity increased
• inadequate guidance for consideration of suitable supervision when the AAS was required to depart the fireground.

Task rejection

Safety issue number: AO-2023-054-SI-04

Safety issue description: There was an inconsistent understanding within New South Wales Rural Fire Service state air desk of the threshold required to action task rejection procedures. Consequently, reports of unsafe conditions on the fireground were not promptly actioned.

Temporary restricted area

Safety issue number: AO-2023-054-SI-05

Safety issue description: The New South Wales Rural Fire Service did not have a procedure to implement a temporary restricted area to reduce the risk of an air proximity event with aircraft not associated with firefighting operations.

Wake turbulence mitigation

Safety issue number: AO-2023-054-SI-06

Safety issue description: The New South Wales Rural Fire Service did not have an effective means to manage wake turbulence separation for aircraft operating in the vicinity of the large air tankers, increasing the risk of an unrecoverable loss of aircraft control.

Cross-border procedures

Safety issue number: AO-2023-054-SI-07

Safety issue description: Neither the New South Wales Rural Fire Service or Queensland Fire and Emergency Service had established cross-border coordination procedures for aerial firefighting activities to ensure reliable aircraft communication and separation.

Safety action not associated with an identified safety issue

Additional safety action by New South Wales Rural Fire Service 

Governance and oversight

The NSW RFS established the Aviation Services Directorate in March 2025 to centralise governance, safety oversight and operational policy for all aviation activities. This created a single accountable structure linking doctrine development, training, and operational delivery. The Directorate provides leadership on strategic planning, resource coordination and risk management, supported by specialist functional areas, such as Fixed Wing Operations, Rotary Wing Operations, Aviation Business and Aviation Safety.

The Aviation Safety Governance Committee was also formalised to provide cross‑directorate oversight of aviation safety performance indicators, monitor Aviation Safety Management System (ASMS – see below) outcomes, and ensure compliance with both Civil Aviation Safety Authority and National Aerial Firefighting Centre frameworks. 

Quarterly safety assurance reviews now integrate training, audit results, and operational performance data. These mechanisms ensure lessons are captured and directly inform continuous improvement cycles, reinforcing transparency and leadership accountability.

Aviation Safety Management System

The NSW RFS developed a formal Aviation Safety Management System (ASMS), following extensive consultation, to provide a structured, agency-wide framework for managing aviation risk, aligning with Civil Aviation Safety Regulations Part 138, ICAO Annex 19 and the Civil Aviation Act 1988. 

The ASMS was approved by the Commissioner in October 2025 and defines governance, accountabilities and assurance processes across all aviation activities. It also integrates hazard reporting, contractor oversight, safety performance indicators, investigation management, and continuous improvement mechanisms. 

The ASMS is administered by the Aviation Safety Manager and overseen by the Aviation Safety Committee, providing structured oversight of safety performance, trend analysis, and corrective action tracking. Safety data is captured in the NSW RFS Safety Hub (DoneSafe platform) and monitored through quarterly governance reviews. 

Through the ASMS, the NSW RFS has strengthened coordination with the Civil Aviation Safety Authority, National Aerial Firefighting Centre and contracted operators, embedding consistent reporting standards and assurance pathways. 

Training, simulation and assurance

Ongoing investment in the Aviation Centre of Excellence has enabled integration of advanced simulation, scenario-based learning, and operator workshops. Between 2024 and 2025, new modules were developed focusing on supervision under stress, airspace deconfliction and communications reliability. 

Pre-season briefings for 2024–25 and 2025–26 incorporated updated doctrine and safety lessons from recent reviews. Annual operator briefings (beginning July 2025) provided a structured forum for information exchange between NSW RFS, contractors, and partner agencies. 

These briefings have also included joint industry engagement with the Aerial Application Association of Australia (AAAA), the Australian Helicopter Industry Association (AHIA), and the National Aerial Firefighting Centre (NAFC), promoting shared understanding of emerging risks, standardisation of safety practices, and alignment of operational expectations across jurisdictions and sectors.

Audit and assurance results are reviewed by the Aviation Safety Governance Committee and directly inform training updates.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• New South Wales Rural Fire Service
• Queensland Fire and Emergency Service/Queensland Fire Department
• the involved flight crews
• Airservices Australia
• National Aerial Firefighting Centre
• AgAir
• Careflight
• Coulson Aviation
• Field Air
• United States Department of Agriculture (Forestry Service). 

References

Australian Transport Safety Bureau (2021), Collision with terrain involving Lockheed Martin EC-130Q, N134CG.

National Aerial Firefighting Centre, National Aerial firefighting strategy 2021-2026, 2021.

National Wildfire Coordinating Group (2022) NWCG Standards for Aerial Supervision. 

New South Wales Rural Fire Service (2023) ‘Air attack supervisor manual’.

New South Wales Rural Fire Service ‘Incident Ground Organisation’, March 2024.

New South Wales Rural Fire Service (2022) ‘Interagency Aviation Standard Operating Procedures’. 

New South Wales Rural Fire Service (2023) ‘Operating guidelines for air tankers operations 2023’.

United States Department of Agriculture (2019) Standards for airtanker operations. 

Western Australia Department of Fire and Emergency Services and Department of Biodiversity, Conservation and Attractions (2023) ‘Western Australia fire suppression procedures 2023-2024’. 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• New South Wales Rural Fire Service
• Queensland Fire Department
• NSW National Parks and Wildlife Service
• Coulson Aviation
• Ag Air
• Field Air /Conair
• Civil Aviation Safety Authority
• National Transportation Safety Board
• United States Forest Service
• incident air attack supervisor
• air operations manager
• incident controller
• state air desk operations manager
• large air tanker coordinator
• state operations controller
• large air tanker air attack supervisor (birddog).

Submissions were received from:

• Coulson Aviation
• New South Wales Rural Fire Service
• Queensland Fire Department
• Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Appendix

Identification of relevant aircraft

The ASA data included any aircraft that had transited the selected geographic area at any altitude. Commercial flights were identified and excluded, as were any other flights above 10,000 ft; these tracks showed the aircraft flying directly overhead, well above the operational firefighting area.

In addition, the NSW RFS provided a list of aircraft potentially active in the area throughout the day, which was data matched against the tracked aircraft, correlating registration with firefighting callsigns.

The data analysis identified 67 aircraft operating in the area of interest, which consisted of a mix of large and small aeroplanes and helicopters. Of these, 40 aircraft were identified as aerial firefighting assets from NSW RFS and Queensland (Qld) Fire and Emergency Services (QFES).[21] The remaining 27 aircraft were not associated with firefighting operations. Of these 27 aircraft, 8 did not have a transponder return or a matched flight plan and were only identified through primary radar returns in the data provided by ASA. As such, identifying details for these aircraft could not be obtained. 

Of the 67 identified aircraft: 

• 19 were contained in the NAFC data set only
• 19 were contained in both ADS-B and NAFC data sets
• 1 had both NAFC and radar returns
• 13 were contained in the Airservices ADS-B data set only[22]
• 15 had radar data only. 

A total of 117 instances were identified where there were gaps of 5 minutes or longer between recorded data points. Of these, 53 were related to time between flights, where the aircraft was on the ground at an airport or aerodrome and 59 were related to the aircraft transiting in and out of the selected area of interest.

The remaining 5 instances related to 3 aircraft:

• One instance of a privately operated Cessna 210, where the transponder was activated about 9 km from Tenterfield Airport (last recorded about 1 hour 42 minutes before arriving at Tenterfield).
• One instance of a privately operated Cessna 182, where the transponder was activated about 20 km from Tenterfield Airport (last recorded about 1 hour 16 minutes before arriving at Tenterfield).
• Three instances of a NSW RFS fixed-wing aircraft with missed returns of 9 minutes, 16 minutes and 5 minutes respectively. These all correlated with the aircraft operating in the same area, at low level (below 2,100 ft AMSL).

In the case of the missed returns from the NSW RFS aircraft in the reviewed data set, this was likely due to terrain and/or aircraft shielding between the aircraft and the receiver. ADS-B receivers require line-of-sight. For periods when an aircraft is operating at low level, this increases the likelihood there was no line of sight to a receiver due to terrain shielding. This may not reflect receipt of the transmission in a secondary, nearby aircraft. Aircraft that are operating in line of sight of the aircraft transmitter, if fitted with an appropriate receiver, may still receive transmissions, although again with potential shielding depending on their respective orientation and relative positions. It was also noted that multiple other aircraft operating below 3,000 ft had short (less than 2 minutes) periods of no recorded transmissions in the reviewed data set, again indicative of terrain shielding.

There was no evidence of any firefighting helicopters turning transponders off during flight. 

Alternatively, in addition to potential shielding between aircraft, given the density of aircraft operating, and potential for electronic flight bag limitations, these limitations may lead to missed transmissions. It was outside the scope of the analysis to review the electronic flight bags, transponders and collision avoidance devices in use by these aircraft.

Investigation summary

What happened

On the morning of 4 November 2023, a Gulfstream 695A, registered VH‑HPY, was being operated by AGAIR on an instrument flight rules flight from Toowoomba to Mount Isa, Queensland. On board the aircraft were the pilot and 2 camera operators. The purpose of the flight was to conduct line scanning of fire zones located north of Mount Isa. 

About 1 hour and 50 minutes into the flight, while the aircraft was in cruise at flight level 280, air traffic control (ATC) lost radio contact with the pilot. Over the following 30 minutes, ATC made multiple attempts to re‑establish contact, including using alternate frequencies and relaying messages via other aircraft in the vicinity. VH-HPY was observed diverging from track and ATC declared an uncertainty phase for the aircraft.

About 20 minutes later, ATC called the pilot’s mobile telephone, and a brief conversation took place. During the conversation, the pilot’s speech was observed as slow and flat. In response, ATC upgraded the aircraft’s status to an alert phase and initiated their hypoxic pilot emergency procedures. About 10 minutes later, the crew of a nearby aircraft was able to establish contact with the pilot, having been requested to do so by ATC. The alert phase was downgraded to an uncertainty phase and, a short time later, ATC re-established direct contact with the pilot. The uncertainty phase was cancelled 1 minute later.

The pilot confirmed that their oxygen system was operating normally, and they were issued a clearance to undertake line scanning north of Mount Isa. Over the following 4 minutes, the pilot repeated the clearance from ATC 4 times, seeming uncertain about the status of the clearance. The radio recordings during this period indicate that the pilot’s rate and volume of speech had substantially lowered from earlier communications and was worsening. The pilot’s final radio transmission displayed the slowest speaking rate of all their communications during the flight and contained stuttering and operational mistakes. Air traffic control did not attempt to re‑establish contact with the pilot until about 18 minutes later, however no further responses from the pilot were received. 

A short time later, the aircraft departed controlled flight, initially entering a descending anticlockwise turn with an increasing rate of descent. At about 10,500 ft, the aircraft likely transitioned into an aerodynamic spin, with a subsequent average rate of descent of about 13,500 ft/min. The aircraft collided with terrain 55 km south-east of Cloncurry. The 3 occupants were fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed post-impact fire.

What the ATSB found

The ATSB found that the aircraft had a long-term intermittent defect with the pressurisation system that would manifest as a reduced maximum attainable cabin differential pressure. The defect was known about by senior AGAIR management who attempted to have the defect rectified. However, they did not formally record the defect, communicate it to the safety manager, undertake a formal risk assessment of the issue, or provide explicit procedures to pilots for managing it. 

Instead, AGAIR management personnel participated in and encouraged the practice of continuing operations in the aircraft at a cabin altitude that required the use of oxygen, without access to a suitable oxygen supply. This included the pilot of the accident flight, with emails and historical flight data indicating they had a pattern of normalised deviation from safe operating practices by continuing to operate the aircraft when the pressurisation system was defective. In these situations, the pilot was found to have managed the effects of hypoxia by undertaking short descents to lower altitudes and use of the aircraft’s oxygen system, which was designed for emergency use only.

It was identified that during the accident flight the pressurisation system probably did not maintain the required cabin altitude, and the pilot probably continued the flight using the aircraft’s oxygen system, which was unsuitable for this purpose. The pilot’s speech, as captured by air traffic control recordings, demonstrated significant and progressive impairment while the aircraft was operating at about flight level 280. This impairment was consistent with altitude hypoxia, which almost certainly significantly degraded the pilot’s ability to safely operate the aircraft.

While the aircraft was in cruise, both power levers were probably reduced without a descent being initiated, resulting in a progressive reduction of airspeed. The aircraft then entered a descending anticlockwise turn with an increasing rate of descent. At around 10,500 ft control input(s) were almost certainly made, probably an attempt to recover, that transitioned the aircraft from a high‑speed descent to an unrecoverable spin condition that continued until the impact with terrain. 

It was found that the AGAIR head of flying operations (HOFO) did not communicate critical safety information about the known intermittent pressurisation defect when they were phoned by air traffic control about concerns that the pilot was impacted by hypoxia around 37 minutes before the collision. This took place at a time when air traffic control could have taken action to instruct the pilot to descend to a safe altitude. 

Air traffic control personnel involved therefore had no knowledge of the aircraft pressurisation defect from that phone call, and without establishing with the pilot why they had not responded to ATC broadcasts for 1 hour and 13 minutes, they likely reduced their vigilance about hypoxia after being told by the pilot that operations were normal. Consequently, ATC did not re-identify the possibility of hypoxia during the subsequent progressive deterioration of the pilot’s speech. Additionally, the air traffic control ‘hypoxic pilot emergency checklist’ contained no guidance on ceasing the emergency response, which increased the risk of inappropriately downgrading the response during a developing hypoxic scenario. 

It was also identified that AGAIR Gulfstream 690 and 695 aircraft were operated with known defects without being recorded on the aircraft’s maintenance releases, likely as a routine practice. This issue had been reported to CASA in 2019 and a surveillance event was conducted in response. The scope of the surveillance event did not include a crosscheck of maintenance releases against the aircraft logbooks, limiting the ability to determine whether any non-reporting and improper deferral of defects had been taking place at that time.

What has been done as a result

AGAIR amended the organisation’s procedural documentation to provide greater detail on the delegation of management responsibilities, maximum cabin altitude requirements, defect reporting, and the capture of cabin pressure information as part of daily aircraft flight and fuel logs. 

AGAIR also incorporated pressurisation, oxygen and line scanning hazards within the organisation’s hazard register. AGAIR has also contracted a continuing airworthiness management organisation and appointed a new head of aircraft airworthiness maintenance control to monitor defect reporting. 

While the ATSB recognises the changes implemented by AGAIR to date, the actions taken do not address the matters raised relating to effective operational control. The HOFO was responsible for ensuring the operation was compliant with aviation legislation and conformed to company standards. However, the ATSB found multiple instances where these requirements were not met. AGAIR has not addressed how the organisation intends to assure future legislative and procedural compliance by line pilots and management personnel. As such, the ATSB has issued a formal safety recommendation to AGAIR to initiate an independent review of their organisational structure and oversight of operational activities to assure ongoing effective operational control by management.

Airservices Australia advised that it is in the process of conducting a review of the hypoxia in-flight emergency response checklist.

Safety message

This accident highlights the dangers of operational practices that intentionally circumvent critical safety defences. The acceptance of these actions at an individual and organisational level normalises that behaviour and exposes the operation to an unnecessarily increased level of risk. 

This accident also underscores the insidious and deadly potential of altitude hypoxia, and pilots need to be alert to this significant hazard when operating at high altitude. Life support and emergency alerting systems are often the final line of defence against hypoxic incapacitation, and they should only be used in accordance with the manufacturer’s procedures. 

Summary video

The occurrence

Overview

On the morning of 4 November 2023, a Gulfstream 695A, registered VH‑HPY, was being operated by AGAIR on an instrument flight rules[1] flight from Toowoomba to Mount Isa, Queensland, with the callsign ‘birddog 370’. On board the aircraft were the pilot and 2 camera operators. The purpose of the flight was to conduct line scanning[2] of fire zones located north of Mount Isa. The flight had been contracted by Queensland Fire and Emergency Services and was conducted as an aerial work operation.

While the aircraft was in cruise at flight level[3] (FL) 280, air traffic control (ATC) radio contact with the pilot was unable to be maintained. ATC made multiple attempts to re-establish radio communications, but these were initially unsuccessful. ATC also declared an uncertainty phase for the aircraft, later upgrading it to an alert phase. After about 1 hour, the crew of a Royal Australian Air Force (RAAF) aircraft was able to make radio contact with the pilot, and ATC re-established communications a short time later. The alert and uncertainty phases were subsequently cancelled.

A series of radio communications were exchanged between the pilot and ATC, during which the pilot was issued a clearance to undertake line scanning north of Mount Isa. The pilot did not respond to any further calls from ATC. The aircraft departed controlled flight and at 1427 (local time) collided with terrain 55 km south-east of Cloncurry (Figure 1). The 3 occupants were fatally injured, and the aircraft was destroyed.

Figure 1: Flight path overview 

Source: Google Earth, annotated by the ATSB

Departure, climb and cruise

At 1055 on the morning of the accident flight, the aircraft departed Toowoomba Airport with the pilot being provided an ATC clearance for the flight to track to Mount Isa. The pilot was initially cleared by ATC to climb to FL160 and was then issued further instruction to continue the climb to the planned cruise of FL280. The pilot made a brief personal phone call at about 1103 (see Telecommunications), and the aircraft reached FL280 at 1120:30 (Figure 2).

Figure 2: Plot of changes in aircraft altitude and the sequence of radio communication events throughout the accident flight from 1045–1300  

Position information including altitude and time was obtained from ADS-B data that was broadcast from VH-HPY. Source: ATSB

At 1126:55 the flight was transferred to, and the pilot established radio communication with, the controller responsible for the Simpson region on the frequency 126.0 MHz (see Airspace). 

At 1141:12, the pilot contacted the controller and requested clearance to descend to FL150. The requested clearance was provided and, a short time later, the aircraft started to descend. The initial rate of descent reached about 3,900 feet per minute (ft/min), but this slowed as the aircraft continued to descend. At 1151:49, the aircraft levelled off at FL150. At 1157:43, the pilot contacted the controller again and requested clearance to climb back to FL280, which was approved. Shortly after, the aircraft began to climb.

At 1210:19, the Simpson region controller requested the pilot change their radio communication frequency to 122.3 MHz, to maintain radio contact with ground equipment as the aircraft flew further west. The pilot established radio communication on the new frequency and reported to the controller that the aircraft was on climb to FL280. At 1221:49, the aircraft levelled off at FL280. 

At 1245:51, the Simpson region controller requested the pilot change their radio communication frequency to 122.1 MHz as the aircraft continued its journey to the northwest. This change was acknowledged by the pilot, but the controller did not receive radio communications from the flight on the newly-assigned frequency. 

Initial loss of radio communications

Between 1247:51 and 1317:48, the Simpson region controller made 12 separate radio broadcasts attempting to re-establish radio communication with the pilot. The controller also attempted to contact the pilot on high frequency radio, and by relaying messages via the flight crew of a passenger transport aircraft that was operating in the vicinity of VH-HPY. 

During this time the controller identified that VH-HPY was diverging from track, by about 2 km laterally, and the shift manager (SM) was informed (see Air traffic services). At 1318:20, ATC declared an uncertainty phase (INCERFA)[4] (see Emergency phases) and the air traffic management director (ATMD) was made aware of the developing situation (Figure 3). 

Figure 3: Sequence of ATC actions and communication events between 1300–1430

Position information including altitude and time was obtained from ADS-B data that was broadcast from VH-HPY. Source: ATSB

At 1337:46, the ATMD attempted to contact the pilot using the mobile telephone number listed on the flight plan, but the pilot did not answer the call. At 1338:36, the pilot returned the ATMD’s phone call, and they had a brief conversation during which the pilot advised that they had ‘no joy’ on radio frequency 122.4 MHz, rather than the instructed frequency of 122.1 MHz (see Telecommunications). The ATMD determined that the pilot’s speech was ‘slower’ than normal and ‘flat’, and these concerns were shared with the SM at the conclusion of the call. At 1340:00, the INCEFRA was upgraded to an alert phase (ALERFA)[5] (see Emergency phases) and the hypoxic pilot in-flight emergency response (IFER) checklist was initiated (see Hypoxic pilot procedures). 

At 1340:15, the controller commenced radio broadcasts to the pilot as part of the IFER hypoxia checklist. These transmissions included the instructions:

- Oxygen, oxygen, oxygen, descend to one zero thousand feet. 

At the same time, the ATMD called the pilot’s mobile phone, but the pilot did not answer. The ATMD left a voicemail message requesting the pilot check their oxygen and call back ATC. 

At 1341:11, the crew of a RAAF aircraft that was in the vicinity of VH-HPY offered to assist the controller to contact the pilot. The controller agreed and a short time later the RAAF crew reported hearing a broken transmission, possibly from VH-HPY, but they were unable to establish contact with the pilot.

At 1341:31, the pilot of VH-HPY transmitted a radio broadcast on frequency 122.1 MHz, providing callsign, flight level, and radio frequency, but the controller was unable to re-establish 2-way communications. Between 1341:31 and 1350:51, the controller continued to broadcast instruction for the pilot to descend the aircraft to 10,000 ft. The controller also attempted further relays via other aircraft in the vicinity of VH‑HPY on various frequencies, including the international air distress frequency 121.5 MHz. 

At about 1348:00, ATC sent 2 text messages to the pilot’s mobile phone and an email requesting they check their oxygen and pressurisation and contact them on frequency 122.1 MHz. No response was received. 

Re-establishment of radio communications

At 1349:13, the crew of the RAAF aircraft advised the controller that they had heard a ‘weak’ transmission from the pilot of VH-HPY on frequency 118.6 MHz. In response, the controller requested the crew of the RAAF aircraft make another broadcast to include the statement ‘oxygen, oxygen, oxygen descend to one zero thousand feet’. The crew of the RAAF aircraft made 2 such broadcasts and, at about 1350, they established contact with the pilot of VH-HPY. 

During this time, the ATMD and SM telephoned the AGAIR head of flying operations (HOFO), advising that contact had been lost with the pilot of VH-HPY and that they suspected the pilot was potentially affected by hypoxia (see Telecommunications).

At 1350:50 the crew of the RAAF aircraft relayed to the controller that VH‑HPY was ‘ops normal’ and maintaining FL280. ATC subsequently downgraded the ALERFA to an INCERFA. At 1351:08, the controller requested that the RAAF crew instruct the pilot to call ATC on frequency 123.95 MHz. At 1351:59, the controller re-established radio communications with the pilot of VH‑HPY on this frequency and the pilot reported ‘ops normal’. About 1 minute later, ATC cancelled the INCERFA phase.

Between 1352:08 and 1357:34, several communications took place between the controller and the pilot. During this time, and 2 minutes after ATC had cancelled the INCERFA phase, the controller asked the pilot ‘just confirm your oxygen system is ops normal’, to which the pilot responded ‘affirm’. The controller later recalled that they had asked about the oxygen system because they had concerns there was a potential hypoxia event and wanted the pilot to look at the oxygen system in case there was a problem. The ATMD recalled that they requested the controller query the status of the oxygen system as a ‘surety check’. The controller recalled that the pilot’s speech at that time was ‘clear and concise’, and they were satisfied with the pilot’s delivery of speech.

At 1357:34, the pilot was provided with an ATC clearance to undertake operations near Mount Gordon. ATC communication recordings showed that the pilot confirmed the clearance at 1357:43, and then twice requested confirmation that the controller had copied their clearance readback (1359:26 and 1400:15). The controller then responded at 1400:19, advising the pilot that the communications were at low strength and could the pilot adjust their microphone. The pilot replied at 1400:57 and the controller then confirmed they had received the pilot’s confirmation of the clearance. At 1401:23 the pilot then confirmed the clearance again. The controller recalled that, during this time, a lot of activity took place near their console related to the status of the aircraft (see Simpson region controller divided attention). 

The radio recordings indicate that the pilot’s rate and volume of speech had substantially decreased from earlier communications and were worsening. During the radio transmission that commenced at 1401:23 the pilot had difficulty pronouncing the location ‘Cloncurry’ and they incorrectly stated the airwork would take place near ‘Mount Ball’, which was then corrected to ‘Gordon’. 

At 1419:19, the controller requested the pilot change frequency to 122.4 MHz, but no response was received. Between 1419:19 and 1427:15 the controller attempted to contact the pilot 8 times without receiving a response.

Departure from controlled flight

Recorded data indicated that, at 1423:20, the aircraft’s airspeed began to reduce from a cruise airspeed of about 236 KTAS.[6] At 1425:25, the airspeed had decreased to about 138 KTAS and the aircraft departed controlled flight (see Flight performance analysis). The aircraft initially entered a descending anticlockwise[7] turn with an increasing rate of descent. At an altitude of about 10,500 ft, the aircraft transitioned into a tight clockwise helical descent, likely an aerodynamic spin,[8] with a subsequent average rate of descent of about 13,500 ft/min (Figure 4). 

Figure 4: Flight path of VH-HPY during the descent from FL280

Source: Google Earth, annotated by the ATSB

Two witnesses at a nearby mining facility observed the aircraft descending in a nose-down, clockwise, corkscrew motion and described hearing a ‘whirring’ noise. The witnesses recalled that motion momentarily stopped part way down, before re-entering the nose-down corkscrew descent.

At about 1427:15, the aircraft collided with terrain 55 km south-east of Cloncurry. The 3 occupants were fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed post-impact fire.

Context

Personnel information

Pilot

Aeronautical experience 

The pilot held an air transport pilot licence (aeroplane) and a commercial pilot licence (helicopter), issued in February 2005 and August 2009, respectively. At the time of the accident, the pilot had accumulated about 4,900 hours total aeronautical experience, which included about 3,200 hours operating turboprop, jet, and high-performance Royal Australian Air Force (RAAF) military aircraft. This included unpressurised aircraft with supplemental oxygen systems (Pilatus PC-9) and pressurised aircraft (Beechcraft B200 and Learjet L35/36). Training records provided by the RAAF indicated the pilot had completed 2 altitude chamber training exercises,[9] one in 1995 and the second in 2019.

Gulfstream 695A training and experience

In August 2023, the pilot commenced work with AGAIR. They had not previously flown a Gulfstream 695A. 

On 15 August 2023, the pilot undertook Gulfstream 695A training and completed a flight review the following day. This training was arranged by AGAIR, and undertaken in VH-HPY, but the training and review were conducted by an independent training provider. 

During the training, the pilot demonstrated competent use of the aircraft systems including management of the pressurisation system. The pilot also conducted a simulated depressurisation scenario from FL150, which involved the use of oxygen and an emergency descent. The training notes made by the instructor about the pilot’s performance during this activity stated:

Emergency descent - best initiated with roll, using the secondary effect (yaw) to pitch the nose down to the required attitude without causing negative load factor. 

The training and flight review were completed within 2.9 hours of flight time and the pilot was assessed by the instructor as competent to operate the aircraft type as pilot in command (PIC). The pilot commenced flying as PIC for AGAIR on 28 September 2023 and they were initially supervised by the AGAIR chief operating officer (COO) over ‘3 or 4 flights’ (see AGAIR chief operating officer actions). There was no training file kept on the pilot’s performance during the supervised flights. 

In the 3 months after starting with the operator until the accident, they had accumulated a total of about 102 hours flight time, all flying VH-HPY mostly undertaking line scanning flights from Toowoomba.

After review of the draft ATSB investigation report the operator provided a record indicating the pilot of the accident flight completed a ‘line check’ flight in VH-HPY on 9 August 2023 with the AGAIR head of flying operations (HOFO). 

Medical information

The pilot held a class 1 aviation medical certificate that was issued on 27 February 2023 and was valid at the time of the accident. Their certificate had a restriction requiring reading correction to be available while exercising the privileges of their licence. The pilot’s aviation medical records were provided for the period 2022–2023 and their general practitioner records were provided for the period 2021–2023. Overall, these records indicated no significant medical conditions or abnormal physical findings. 

At the time of the accident, the pilot was taking medication for high cholesterol. In 2019 they underwent a coronary angiography, which showed no calcium and no soft plaque formation. The pilot had also visited a cardiologist in December 2021 due to family history, and undertook a stress electrocardiogram in November 2022, which identified no issues. In April 2023, the pilot injured their Achilles tendon and underwent surgical repair. The injury was reported to the Civil Aviation Safety Authority (CASA) on 18 April 2023, and the pilot was cleared to resume flying duties on 22 May 2023. The pilot was reported to have recovered well from their Achilles injury. Overall, the pilot was reported to have been fit, active and healthy, with no known stressors. 

Recent history

The pilot had 8 duty free days prior to the commencement of their most recent period of duty. This period started on 1 November 2023. They conducted a 1.3 hour flight from Essendon, Victoria, to Hay, New South Wales, on 1 November, and a 3.7 hour flight from Hay to Toowoomba on 2 November.

The pilot was reported to have gone to bed at around 2030–2100 the night prior to the accident and was known to wake early and undertake morning exercise. The collision with terrain occurred mid-afternoon after they had been flying about 3.5 hours that day. The ATSB reviewed their recent work-rest history and based on the available evidence, it was considered very unlikely that the pilot was experiencing a level of fatigue known to adversely affect performance.

Camera operator 1

Aeronautical experience

Camera operator 1 joined AGAIR in July 2021. They were not employed as a pilot by the organisation, but they held a commercial pilot licence (aeroplane), issued in February 2020. At the time of the accident, they had about 434 hours total aeronautical experience, including 72 hours on multi-engine piston aircraft.

Medical

Camera operator 1 held a class 1 aviation medical certificate that was issued on 14 November 2022 with no restriction. The medical certificate was valid at the time of the accident. Their aviation medical records were provided for the period 2021–2022. These examinations indicated no significant medical conditions or abnormal physical findings. Camera operator 1 was reported to be in ‘very good health’ with no known medical conditions.

Camera operator 2 

Aeronautical experience

Camera operator 2 was a United States citizen who had experience in the construction and operation of the imaging system fitted to VH-HPY (see Aerial survey camera system). They joined AGAIR in October 2023, and had conducted 5 line scanning flights in VH-HPY prior to the accident flight. They did not hold a flight crew licence, but they had received about 4 hours instructional flight training in the year prior to the accident. 

Medical

Camera operator 2 did not hold an aviation medical certificate, nor were they required to. They were reported to be ‘very healthy’ with no known medical conditions.

Post-mortem and toxicology 

Autopsy results

The post-mortem examinations determined that the occupants of the aircraft had sustained multiple injuries during impact that proved fatal. The results of the examinations did not indicate any significant natural disease that could have contributed to the accident. However, the examinations were limited due to the nature of the impact and resulting fire. There were no indications that the occupants of the aircraft had inhaled products of combustion.

Toxicology results

Toxicology testing was conducted and no drugs were detected, however the validity of the testing was degraded due to changes that occur post-mortem. Alcohol and carbon monoxide testing could not be completed using the samples obtained. 

Aircraft information

General information

The Gulfstream 695A is a high-wing, pressurised, twin-engine aircraft powered by 2 Garrett TPE331-10-511K turboprop engines. The aircraft was designed as a business and personal aircraft with seating capacity of up to 11 people.

The accident aircraft, serial number 96051, was manufactured in 1982 and in January 1983 commenced operations in South Africa. During this time the aircraft’s air conditioning system was replaced with an approved alternative system.[10] In 2014, prior to the aircraft being exported to Australia, the aircraft underwent refurbishment, which included a new avionics suite and interior, and the aircraft was repainted. Additionally, the original Dowty Rotol propellers were replaced with Hartzell propellers under a supplemental type certificate.[11]

The aircraft was first registered in Australia as VH-HPY on 11 November 2014. Its registration was held by AGAIR since 14 September 2016 and was initially used for birddog flights[12] (Figure 5). 

The aircraft was configured with 2 crew seats, 4 passenger seats, and a bench seat in the rear. The last periodic inspection was completed on 1 November 2023. At this time, the aircraft had accumulated 7,566.1 hours total time in service.

Figure 5: VH-HPY August 2023

Source: Cameron Marchant

Aircraft systems

Aerial survey camera system

To expand its operational capabilities, AGAIR elected to modify VH-HPY to undertake aerial surveys of natural disasters such as bushfire and flood by fitting an Overwatch Imaging TK‑7 camera system. 

To modify the aircraft, AGAIR engaged an approved aircraft design organisation to prepare the engineering order,[13] and the installation was carried out by General Aviation Maintenance (GAM). Work on the modification began in June 2021 and had been partially completed when the aircraft recommenced operations in August 2021. In November 2021, VH‑HPY returned to GAM and the modification was completed and certified on the maintenance release.[14] The engineering order, associated drawings, and a flight manual supplement specific to VH-HPY, were approved by the aircraft design organisation in February 2022.

Pressurisation system

Generally, aircraft that are intended to be operated at altitudes over 10,000 ft are equipped with a pressurisation system. As the aircraft climbs, the air pressure outside the cabin decreases, and at the same time the aircraft’s pressurisation system maintains the pressure inside the cabin to a level that allows normal breathing (without the use of supplemental oxygen). The environment maintained by the pressurisation system is known as the cabin altitude. The difference between the pressure inside the cabin and the pressure outside the cabin is known as cabin differential pressure. Pressurised aircraft have a stipulated maximum differential pressure because of the loads that pressurisation places on an aircraft’s fuselage.

The Gulfstream 695A is pressurised by ducting air from both engines (known as bleed air) into the cabin and controlling its flow overboard via outflow safety valves to maintain the desired cabin pressure. The source of bleed air can be selected within the cockpit. A cabin pressure controller, also located within the cockpit, is used to manage the cabin pressure from take-off, through climb, cruise, and descent. The controller also prevents exceedance of the maximum differential pressure of 6.8 psi (see Appendix A – Gulfstream 695A systems information). The Gulfstream 695A is certified to operate up to 35,000 ft above mean sea level. At this altitude, and at the maximum differential pressure, the cabin altitude would be 9,600 ft. The pilot’s operating handbook (POH) requires the pilot to ‘limit flight altitude to maintain 10,000 ft cabin altitude’ should the cabin altitude exceed the selected value.

Figure 6: VH-HPY cockpit layout 

Note: Image captured prior to the accident. Source: Cameron Marchant, annotated by the ATSB

The Gulfstream 695A is fitted[15] with a cabin altitude visual and aural warning system that activates when the cabin altitude is at or above 11,000 ft (±500 ft) (Figure 6). When activated, ‘CABIN ALT’ illuminates in red on the glareshield annunciator panel and flashes for 10–20 seconds before remaining steady. This is accompanied by an aural tone that pulses 6 times per second. The aural warning can be silenced by pressing a button on the left engine power lever (see Appendix A – Gulfstream 695A systems information).

In the event of illumination of the ‘CABIN ALT’ annunciator, accompanied by the aural warning tone, the POH requires the pilot to don their oxygen mask, verify passengers were receiving oxygen, and initiate a descent to 12,000 ft or below (Figure 7).

Figure 7: Cabin altitude annunciator emergency procedure

Source: Ontic

Oxygen system

The Gulfstream 695A is equipped with an oxygen system that provides life support in the event of an emergency. The POH states that:

The airplane is equipped with a high pressure, gaseous oxygen system which provides supplemental breathing oxygen to the crew and passengers in the event of cabin depressurization during high altitude operation, or in the event cabin air becomes contaminated. The system will provide oxygen for sufficient time to permit a planned descent to an altitude where supplemental oxygen is no longer required.

Oxygen is stored in a cylinder located in the rear fuselage and, when full, can supply oxygen to 3 people for about 29 minutes. The cylinder is full when filled to 1,800 psi. The passenger oxygen system switch is recessed into the sidewall on the right side of the cockpit, alongside a cylinder pressure gauge for the aircraft oxygen system (see Appendix A – Gulfstream 695A systems information).

The pilot and copilot oxygen masks are designed for rapid donning and are positioned on hooks immediately behind the pilot and copilot seats for ease of access. The masks incorporate a microphone for radio communications. Passenger oxygen masks are stowed in containers at various locations in the cabin lining above the passenger seats (see Appendix A – Gulfstream 695A systems information). 

Autopilot

The autopilot fitted to VH-HPY was a Collins AP-106 and it was integrated with the aircraft’s instruments. The Collins AP-106 is a 3-axis system that stabilises the aircraft about its roll, pitch, and yaw axes. The system can operate in various modes including pitch hold, heading, navigation, approach, back-course, altitude, and indicated airspeed. Both pilot and copilot control wheels have an autopilot release switch (see Appendix A – Gulfstream 695A systems information). 

A subcomponent of the autopilot system, the trim servo monitor, has fault detection and diagnostic capabilities that automatically disengage the autopilot if a discrepancy or malfunction is detected. One such potential fault condition is the exceedance of threshold voltages within a servo as it works against an aerodynamic or mechanical force. 

The ATSB interviewed 3 pilots who had previously flown VH-HPY for AGAIR. Two pilots described the autopilot as being unreliable at times. One recalled that the autopilot would not hold altitude well and would ‘chase’ the target by +/- 100 ft. Another recalled that the system would be fine in smooth air, but if the aircraft experienced turbulence that required multiple control inputs, the autopilot would disconnect without any prior indication after about 10 minutes. Another pilot regarded the autopilot favourably. Maintenance records for VH‑HPY show multiple instances of autopilot defects and subsequent rectifications.

Engine controls

The Gulfstream 695A engines are controlled from the cockpit using a power lever and a condition lever for each engine. The autopilot does not interface with the engine controls.

Radios

The aircraft was fitted with very high frequency (VHF) and high frequency (HF) radios, along with an additional communication unit for birddog flights and a satellite phone. Pilots wore headsets with boom microphones and were able to transmit by pressing a thumb-operated button on the outboard grip of each control wheel. Handheld microphones were also stowed on each control column.

On the day of the accident, routine communications between air traffic control and VH-HPY were via VHF. VHF radio is limited to ‘line of sight transmissions’, with communication range increasing with aircraft altitude.

Maintenance history

Recent maintenance

The ATSB reviewed the maintenance records for VH-HPY. This included records from when the aircraft was operating in South Africa (from 1983 to 2014) and the Australian records (from 2014 to 2023).

The last maintenance activity prior to the accident was carried out by General Aviation Maintenance (GAM) at Essendon Airport, Victoria, in late October 2023. The work carried out was predominately scheduled maintenance along with some minor defect rectifications. The maintenance provider also carried out checks on the left and right engine bleed air valves after being informed by the AGAIR chief operating officer (COO) that the pressurisation system was malfunctioning (see Aircraft pressurisation defects). The aircraft was released for service on Wednesday 1 November 2023, 3 days prior to the accident flight. The maintenance provider advised that after the first flight, the pilot who accepted the aircraft called and reported to them that the aircraft systems including pressurisation were working normally.

Aircraft pressurisation defects

In 2011, while the aircraft was operating in South Africa, the cabin door seal was replaced to address a pressurisation issue. In 2013 a defect was recorded where the maximum cabin differential pressure of 6.8 psi could not be reached. It was determined that cabin air was leaking from the cabin doorstep area, and this was rectified. Correspondence showed that, when preparing the aircraft to be exported to Australia, the aircraft was not capable of attaining the maximum cabin differential pressure. Significant work was carried out to rectify the issue, including major component replacements, and the cabin interior was removed for access to seal the fuselage.

When VH-HPY was purchased by AGAIR in 2016, maintenance was then provided by GAM at Essendon Airport. The aircraft was reportedly difficult to pressurise when it arrived, which was identified to be because of a leak from a sub-component of the pressurisation system known as a volume tank. Additionally, to address the pressurisation issue a few minor cabin leaks were repaired. A pilot who had flown VH-HPY when it initially entered service with AGAIR recalled that its pressurisation system did function, however if the aircraft rate of climb was high, the pressurisation system would malfunction.

Two of the pilots who had previously flown VH-HPY for AGAIR recalled intermittent pressurisation issues, where the aircraft would not pressurise higher than 2 psi differential pressure. The third pilot reported the pressurisation was okay but had noticed the high rate of climb issue. The unreliability of the pressurisation system reportedly could be managed by selecting the maximum flow of bleed air to the cabin (which can be used at any time except take-off and landing), and by turning the cabin heating up. Additionally, it was also reported that pressurisation seals in the cockpit for the rudder controls were known to leak, and during a flight in late August 2020, the seal dislodged and depressurised the aircraft. On 4 August 2023, the AGAIR HOFO said to GAM that the pressurisation system was working ‘perfectly’.

On 16 October 2023, the pilot of the accident flight emailed the AGAIR COO stating that the pressurisation of VH-HPY was ‘stuck on 2.0 differential for [a] prolonged period’ and because they needed to operate at FL280, they had ‘used a bit of oxygen’ (see Pilot of the accident flight actions). According to the Gulfstream 695A POH, operating at FL280 with a differential pressure of 2.0 psi will result in a cabin altitude of 19,800 ft. The email also requested the aircraft oxygen cylinder be refilled by a maintenance provider at Toowoomba, Queensland where the aircraft was based at the time. Records from the maintenance provider showed that the oxygen cylinder was serviced (refilled) from 1,000 psi to 1,700 psi on 18 October 2023 (see Appendix A – Gulfstream 695A systems information).

On 22 October 2023, the pilot of the accident flight emailed the AGAIR COO and chief executive officer (CEO), who also held the positions of HOFO and head of aircraft airworthiness maintenance control (HAAMC), advising them of issues relating to the pressurisation system of VH-HPY. The email stated there was ‘no change…same cycles and fixes’. The defect was described in the email as the cabin differential being stuck at 2.2 psi (see Pilot of the accident flight actions). 

On 27 October 2023, the AGAIR COO operated the aircraft as PIC and captured a video that showed the aircraft at FL280 with a cabin altitude of 19,000 ft (see AGAIR chief operating officer actions). The COO attempted to ascertain why the pressurisation system was malfunctioning by using the bleed air selector (see Appendix A – Gulfstream 695A systems information) to shut off engine bleed air from each engine in turn. When the pilot selected ‘RIGHT CLOSE’, there was no change in cabin altitude, or when ‘BOTH OPEN’ was re-selected. When ‘LEFT CLOSE’ was selected, the cabin vertical speed indicator showed the cabin altitude climbing at 2,000 ft/min. 

The video was sent to the maintenance provider and the aircraft was flown to their facility on 29 October 2023 for scheduled maintenance. The left and right engine bleed air valves were removed and functionally checked in-house before being refitted to the aircraft. The maintenance provider reported that no faults were found during the valve functional checks or when the pressurisation system was later checked on the ground. The maintenance provider stated that, prior to the completion of maintenance, the aircraft oxygen system was refilled. A maintenance release was issued on 1 November 2023 and the aircraft re-entered service.

Service letters to address cabin leaks

In September 2008, the then type certificate holder for the Gulfstream 695A, and other aircraft in the series, issued 2 service letters with guidance for addressing cabin pressurisation leaks. Service letter 382 was for aircraft in the series that were pressurised ‘to the floor’, while service letter 383 was for aircraft that were pressurised ‘to the skin’. Service letter 383 was applicable to the Gulfstream 695A and it stated:

A recurring problem in pressurized Twin Commanders is maintaining cabin pressure when flying at high altitude. This publication is presented in an effort to standardize the procedure for sealing the known and most significant leakage areas.

The service letter advised that to establish a leakage rate, the aircraft was to be pressurised on the ground using either the engines or with a pressurisation unit. Aircraft that exceeded the maximum allowable leakage rate required rectification. The service letter identified the locations where the most significant leaks occur and provided detailed instructions to address them.

Operations with unserviceable pressurisation system components

The Gulfstream 695A POH contains a minimum required equipment list (MREL) detailing components and systems that must be operable for the aircraft to be considered airworthy. It also lists components and systems that can be inoperable provided that certain operating limits were followed. For inoperative pressurisation system components, the MREL operating limitation requires the aircraft to be only operated unpressurised (see Supplemental oxygen legislative requirements).

Recording of aircraft defects

Requirements

The maintenance release document used for VH-HPY was a standard Civil Aviation Safety Authority (CASA) form 918. The document was used to identify the maintenance release period of validity, list scheduled maintenance due in that period, and to record the hours flown along with landings and pressurisation cycles.[16]

Another principal function of the maintenance release was to record defects and major damage that occurred during the maintenance release period of validity and show the actions taken to rectify them. Part 4B of the Civil Aviation Regulations 1988 did not make a distinction between minor and major defects. However, major defects were defined as:

… those that have caused, or that could cause either: a primary structural failure, a control system failure, an engine structural failure, or a fire. 

Parties required to make entries (known as endorsements) on the maintenance release for defects or damage included the holder of the certificate of registration, the operator, and the flight crew. When a defect was endorsed on the maintenance release, the aircraft was not able to be flown until a formal assessment and deferral of the defect was carried out, or an entry was made to ‘clear’ the original endorsement (known as a clearing endorsement). Clearing endorsements were generally made by approved maintenance personnel, and in accordance with approved data such as the aircraft maintenance manual.

The AGAIR operations manual (OM) required the PIC to record defects and their symptoms on the aircraft’s maintenance release. The PIC was then required to liaise with the HAAMC, who would in turn liaise with the maintenance provider to determine what action was required.

Provision was given in the OM to defer defects that ‘do not impinge on the airworthiness of the aircraft’. Examples of this were given in the manual:

...the Pilot-in-command must consider whether or not the defect will render the aircraft unserviceable for a particular category or type of operation. For instance an unserviceable landing light would not render the aircraft unserviceable for day VFR operations but would render it unserviceable for night operations.

…

…some minor defects such as paint scratches or dents in the structure would not normally impinge on airworthiness whereas cracks in a wing spar certainly would.

The OM contained provision for the use of minimum equipment lists (MEL) supplied by the aircraft manufacturer. Prior to their use by AGAIR, an MEL was required to be approved by CASA, specific to a particular aircraft and operator. The MEL[17] provisions stated in the Gulfstream 695A POH were not approved for use with VH‑HPY at the time of the accident.[18]

Unapproved recording of defects

Some defects that were identified on VH‑HPY and another AGAIR aircraft, VH‑LVG, were recorded using unofficial means to the operator or maintenance provider. On 21 April 2021, the AGAIR HOFO emailed GAM requesting various tasks to be carried out on VH‑HPY, VH‑LVG, and VH‑LMC when the aircraft arrived for maintenance. The email also listed defects on each of the aircraft. None of the 4 defects listed for VH‑HPY in the email had been entered on the relevant maintenance release. Other examples included emails from the pilot of the accident flight to AGAIR managers describing a pressurisation defect with VH‑HPY (see Recording of pressurisation defects), and an internal GAM email listing defects on VH‑LVG.

The ATSB interviewed pilots who had flown VH‑HPY for AGAIR. One pilot recalled that defects would be communicated by phone to GAM. Other pilots recalled that defect lists were compiled to be rectified during the aircraft’s next scheduled maintenance. 

The ATSB reviewed a total of 15 expired maintenance releases¹⁴ that had been retained with the maintenance logbooks from VH-HPY. These maintenance releases dated from November 2014 when VH‑HPY was first registered in Australia. Of these maintenance releases, 13 were from when the aircraft commenced operations with AGAIR in September 2016, and defect entries had been made on 6 of these. The defect entries had been predominately made by the maintenance provider, and the remaining 7 maintenance releases were either blank or had entries for scheduled maintenance activities.

Recording of pressurisation defects

After VH-HPY sustained an in-flight depressurisation in August 2020, an entry for the defect and a clearing endorsement was made by a licensed aircraft maintenance engineer (LAME) on the maintenance release. 

Of the remaining known instances of pressurisation defects, there were no relevant entries on the aircraft’s maintenance releases (Table 1).

Table 1: Recording of known pressurisation defects affecting VH‑HPY since 2016

Meteorological information

Meteorological records[19] from the Bureau of Meteorology (BoM) at the time of the accident were reviewed by the ATSB. This predicted westerly winds at 40 kt, temperature −30°C, with no significant nearby weather events at FL280.

Meteorological conditions were also recorded by the BoM automatic weather station at Cloncurry Airport (55 km north-west of the collision location). At 1430 the surface wind was 6 kt from 190° true, visibility greater than 10 km, no detected cloud, temperature 40°C, dew point 2°C, and no rainfall since 0900.

Recorded data 

The aircraft was not fitted with a flight data recorder or a cockpit voice recorder, nor was it required to be. During the accident flight, data was being transmitted by the automatic dependent surveillance broadcast (ADS-B) and Mode S transponder[20] equipment fitted to the aircraft. Flight data was also being broadcast from a TracPlus[21] unit fitted to the aircraft, which could be used by the fire services and AGAIR to track the location of the aircraft during flight. A navigational application (OzRunways) was installed on a tablet computer on board the aircraft and that device also broadcast flight data. The OzRunways data was recorded at 5 second intervals. The parameters captured from all systems were: time, aircraft position, GPS and pressure (barometric) altitude, altitude rate of change, groundspeed, and heading.

Navigation system

A Garmin GTN-750 navigation system was recovered from the accident site and transported to the ATSB Canberra technical facility. Examination of the unit identified that it was not recording flight data. 

ADS-B data

The ADS-B data provided the highest reporting frequency (~0.5 seconds), and altitude was reported to the nearest 25 ft. This data was captured from shortly after departure until the aircraft descended to about FL240 during its final descent (Figure 8). 

Figure 8: Altitude profile of the accident flight throughout its duration with key moments (phases) displayed

The blue trace represents pressure altitude and the green trace represents GPS altitude. Source: ATSB

Pressure and global positioning system altitude discrepancy

The ADS-B data that was broadcast from the aircraft during the accident flight contained a discrepancy between the pressure altitude and the GPS altitude (Figure 8).[22] At the start of the second cruise phase, the broadcast pressure altitude was 28,000 ft while the GPS altitude was 29,400 ft. At the end of the second cruise phase (approximately 2 hours later), the broadcast pressure altitude was 28,050 ft while the GPS altitude was 29,750 ft. The difference in pressure and GPS altitudes over the entire flight varied with altitude and flight time and is shown on a scatter plot below (Figure 9).

Figure 9: Scatter plot of pressure and GPS altitude discrepancy with altitude (left) and over time (right)

Source: ATSB

When the above data was corrected for local barometric pressure and GPS ellipsoid modelling, the difference in altitudes at the end of the second cruise phase of flight was about 1,400 ft. The GPS altitudes from ADS-B, OzRunways and TrackPlus, which had independent GPS sources and data processing, were broadly aligned over the entire flight, and it is therefore likely that the pressure altitude was reading low and the aircraft was likely flying at FL294 (i.e. the actual position of the aircraft was likely higher than indicated). The reason for the discrepancy could not be determined, although a static source leak inside the cabin could not be discounted. 

Initial descent to FL150

At 1141:12, while at FL280, the aircraft commenced a descent to FL150. The aircraft’s flight profile during this period was erratic with a fluctuating rate of descent that peaked to about 4,200 ft/min. The aircraft’s heading remained steady during the descent. The aircraft then maintained FL150 for a period of about 6 minutes before climbing back to FL280. No reason for the descent was provided to air traffic control and it was not part of the submitted flight plan. The AGAIR COO stated there was no operational reason for the descent to occur.

Flight performance analysis

General

The ADS-B, OzRunways and TrackPlus position and groundspeed data, combined with aircraft performance data, forecast conditions, and actual environmental conditions, were used to formulate likely aircraft performance during the flight. The engine power (maximum continuous power (MCP)), knots true airspeed (KTAS), knots calibrated airspeed (KCAS),[23] and vertical speed was calculated at points in time during the initial cruise, initial descent and the secondary cruise (Table 2). 

Table 2: VH-HPY performance assessment

Source: ATSB

Trajectory analysis was used to estimate the likely pitch angle, angle of attack, roll angle, speed, and rate of descent for the deceleration and loss of control phases of the flight.

Deceleration phase

Commencing at 1423:20, the deceleration phase of the flight was assessed from 10 seconds after the transition from cruise until the start of the left descending turn (Figure 10). Over this 2‑minute period, the altitude reduced from 28,040 ft to 27,840 ft, with an initial vertical descent rate of 78 ft/min, increasing to 120 ft/min. However, over this same loss of altitude, a more substantial loss of airspeed occurred with a linear airspeed reduction from 236 KTAS (148 KCAS) to 138 KTAS (86 KCAS). This descent performance was estimated to require a power setting of about 25% MCP.

Figure 10: Deceleration phase

Source: ATSB

The aircraft stall speed at maximum weight was 78.6 KCAS. The corrected stall speed at the calculated operating weight of the aircraft was about 74 KCAS, 12 kt lower than the calibrated airspeed at the end of the assessed period. It was calculated that the aircraft had approximately 25% MCP applied at the end of the descent, which would slightly decrease the stall speed, giving further margin from the stall. 

The minimum control speed in the air (V_MCA)[24] for the aircraft was documented to be 95 KCAS. However, this speed assumes one engine inoperative with the other at MCP. Assuming in this instance one engine failed inoperative, and the other engine remained at half power (that is, total aircraft power at 25%), the minimum control speed was calculated to have been approximately 67 KCAS. This was below the power off stall speed for the aircraft weight and below the recorded minimum speed. Thus, a minimum control speed departure was excluded as a potential reason for the flight profile of the aircraft.

Loss of control

The reliability of the ADS-B data diminished as the aircraft entered the descending left turn. However, trends in the data were able to be identified. At 1425:26 and an airspeed of about 78 KCAS, the aircraft entered a left roll. The roll rate was initially about 10 degrees per second (°/s), slowing to 0°/s 14 seconds later whereby the aircraft had rolled to approximately 75° left angle of bank. The angle of attack (AoA)[25] was estimated to stay reasonably constant over this period at around 8°, indicating a fixed elevator position. However, it was calculated from the data that the aircraft pitched to about 20° nose down due to the fixed AoA and excessive roll angle allowing the nose to drop. 

At 1425:40, the aircraft’s heading had turned through 85° and it had accelerated to about 106 KCAS. From this point, over the following 10 seconds, the angle of bank was estimated to reduce to around 45° and the nose-down pitch change slowed until it stabilised about 30° nose down all while the calculated AoA remained constant at around 8°. During this period, the aircraft’s heading turned through a further 100° and the speed increased to about 189 KCAS. The diameter of the turn was approximately 700 m (Figure 11). 

Figure 11: Deceleration and loss of control

Source: ATSB

Because of the extreme attitude of the aircraft from this time on, the ADS‑B data and TrackPlus data became unreliable, likely due to the angle of the onboard antenna and reflected signals. The last reliable ADS‑B position information occurred at 1425:50 and at 25,500 ft standard barometric altitude and 189 KCAS. Only horizontal ADS-B position information remained valid for another 5 seconds, by which point the aircraft had turned through a ~270° track angle and crossed back through its original track. 

From this point, to about 10,500 ft, all data sources became unreliable and sporadic and no conclusions about flight path or attitude could be made. However, the data indicated an average vertical speed of about −19,500 ft/min, or 192 kt vertical speed, during the period from about 25,000 ft to 10,500 ft. 

At about 10,500 ft, the OzRunways altitude data stabilised and provided an average vertical descent rate of 13,500 ft/min. The final data point was at 1427:15 at an altitude of 1,800 ft. 

Wreckage and impact information 

Accident site

The aircraft was destroyed by the impact with terrain and a subsequent fuel-fed post-impact fire (Figure 12). The ATSB conducted an onsite examination of the aircraft wreckage. The ground impact marks and wreckage position indicated that the aircraft impacted terrain upright with a shallow, nose-down attitude with little forward momentum. Immediately surrounding the wreckage, numerous landscape features (a tree and termite mounds) remained upright and had not been disturbed by the aircraft impact or its liberated debris (Figure 13). The compression and displacement of the aft fuselage relative to the engines, the displacement of the inboard wing section and the aircraft nose, showed that the aircraft was rotating clockwise on impact with the terrain, which was highly indicative of a spin. 

Figure 12: Overview of the accident site

Source: Queensland Police, annotated by the ATSB

Figure 13: Heavily disrupted and burnt remnants of the wreckage at the accident site 

The surrounding landscape features (termite mounds and a tree) remained upright and were not disturbed from the impact. Source: ATSB

All major aircraft components were accounted for at the accident site. The disruption to the airframe from the impact and the subsequent fire damage limited the extent to which the aircraft could be examined. The oxygen cylinder fitted to the aircraft was located in the wreckage and its associated components had been significantly fire damaged, precluding any assessment of the oxygen system’s serviceability prior to the accident. Additionally, the components comprising the pressurisation system were unable to be assessed due to the extent of damage sustained.

Engines

Both engines had been significantly damaged by the post-impact fire, limiting the extent to which they could be examined. However, the low-pressure compressor of each engine was observed to have rotational damage, indicating that the engines were operating at impact.

Propeller assemblies

Both propellers were examined and photographed by the ATSB at the accident site. Assistance was sought from Hartzell Propeller personnel to interpret the photographic evidence. They advised that there were multiple indications to identify that the engines were operating and estimated them to be at a low to moderate power setting. These indications included blade bending (in multiple planes), twisting, fractures (including multiple blade tip fractures), chordwise scoring and rotational gouges. Additionally, blades from both propellers had separated from their hubs at the shanks, and internal components were fractured.

Crew locations

The pilot was found toward the front of the cabin, camera operator 1 was behind and to the left of the pilot, and camera operator 2 was behind and to the right of the pilot. However, the impact with terrain caused significant compressional damage to the cabin area of the fuselage and the location of the crew as found within the wreckage may not be indicative of their seated location during the flight. 

Fire 

Witnesses from a nearby mine site who observed the aircraft during its descent did not report any indications of fire until the aircraft collided with the ground, after which a fireball and rising smoke plume were visible. A fuel-fed fire persisted after the impact, which consumed most of the aircraft wreckage. The fire was extinguished by responders from the mine site.

Survivability

The impact with terrain was not survivable. 

Hypoxia

General

Hypoxia is a state where there is a deficient supply of oxygen in the blood, tissues and cells sufficient to cause an impairment of body functions. The human central nervous system demands about 20% of all inhaled oxygen to supply the brain. Any reduction in oxygen supply to the body will impact brain function, with higher reasoning portions affected first (US Federal Aviation Administration 2015). Severe exposure to hypoxia can result in the rapid deterioration of most bodily functions and, eventually, death (Gradwell 2016).

Hypoxia can result from a variety of factors including respiratory and cardiovascular deficiencies, blood disorders, pharmaceuticals and toxic substances, and a reduction in the oxygen tension in the arterial and capillary blood. The latter factor is known as altitude hypoxia, hypobaric hypoxia, or hypoxic hypoxia, and it is the most common form of oxygen deficiency in aviation (Gradwell 2016).

Altitude hypoxia

Within aviation, the typical cause of altitude hypoxia is the low oxygen tension of inhaled gas (air) associated with exposure to altitude. On ascent, as barometric pressure reduces, breathing ambient air will result in a reduction of the partial pressure and the molecular content of oxygen within the lungs. The result is an inadequate oxygen supply to the arterial blood and decreased oxygen available to the tissues (Gradwell 2016). 

Clinical features of altitude hypoxia

The clinical features of altitude hypoxia are described in Table 3. In general, the greater the altitude, the more overt and serious the features of hypoxia will be. Except for a possible headache, nausea or dizziness, a pilot is unlikely to experience other uncomfortable symptoms (US Federal Aviation Administration 2015). A loss of self-criticism usually results in a person remaining unaware of their deterioration in performance and, consequently, the presence of hypoxia. It is this insidious nature that makes the condition a significant hazard in aviation (Gradwell 2016). 

As noted in the table, although there is minimal impact below 10,000 ft, research has shown impaired task performance (with individuals unaware of their impairment) at cabin altitudes below 15,000 ft. With reference to the effect of altitude hypoxia on the performance of pilots, studies have shown an increase in procedural errors (Nesthus and others 1997), reduced flight profile accuracy (Steinman and others 2017), and reduced awareness of the environment (Steinman and others 2021). 

Table 3: Clinical features of altitude hypoxia 

Source: Gradwell (2016)

Time of useful consciousness

The time of useful consciousness (TUC) is the interval between a person being exposed to a reduction in oxygen tension of the inhaled air to the time when they experience a specified degree of performance impairment (Gradwell 2016). It can also be considered the time after which an individual is no longer capable of taking appropriate corrective action to resolve the situation (for example, the use of oxygen and/or a descent to a lower altitude). The TUC does not denote the time to the onset of unconsciousness (US Federal Aviation Administration 2015).

The TUC at various altitudes is presented in Table 4. However, TUC is subject to considerable variation based on an individual’s general physical fitness, age, degree of training and previous experiences of hypoxia (Gradwell 2016). It is also affected by the rate of ascent, with a faster ascent resulting in a shorter TUC. For example, during a rapid depressurisation to altitudes between 25,000 ft and 43,000 ft, the TUC is reduced by about 50% (US Federal Aviation Administration 2015). 

Table 4: Time of useful consciousness at various altitudes

Source: US Federal Aviation Administration (2015)

Principal aviation causes

Within the aviation context, the principal causes of altitude hypoxia are: 

• climbing to high altitudes without the use of supplemental oxygen
• failure of the supplemental oxygen system, or oxygen set to an inadequate concentration and/or pressure
• depressurisation of the cabin at a high altitude (Gradwell 2016).

Post-mortem indicators of altitude hypoxia

Altitude hypoxia rarely leaves any indications that would be detectable at a post-mortem examination.

Supplemental oxygen legislative requirements 

The Civil Aviation Safety Regulation (CASR) part 91 (general operating and flight rules) manual of standards 2020 required flight crew[26] to use supplemental oxygen:

• for any period exceeding 30 minutes when the cabin pressure altitude was continuously at least FL125 but less than FL140
• for any period when the cabin pressure altitude was at least FL140.

For passengers, an oxygen supply was required to be available for the entire period for any time when the cabin pressure altitude was at least FL150. Additionally, an aircraft was required to carry sufficient oxygen to meet the above requirements, and the oxygen was required to be made available through an oxygen dispensing unit in accordance with the supply requirements for that level.

Without affecting the above requirements, the same legislation also required a pressurised aircraft that was flown at an altitude of FL250 or more to have:

• at least 10 minutes oxygen supply for flight crew, even if the entire period of relevant flight was less than 10 minutes
• at least 10 minutes oxygen supply for passengers after descending below FL250 even if the entire period of relevant flight was less than 10 minutes.

The oxygen system fitted to VH-HPY complied with the legislative requirements to have a 10‑minute supply when operating the aircraft at FL250 or higher when pressurised. However, as described in Aircraft systems, the oxygen system for Gulfstream 695A aircraft was for emergency purposes (depressurisation, smoke and fumes etc) and not for the purpose of conducting normal operations (also see Appendix A – Gulfstream 695A systems information).

Operational information

Tasking

The flight had been contracted by Queensland Fire and Emergency Services (QFES) and the crew had been tasked to conduct line scanning of 10 areas of interest in Northern Queensland. The line scanning activity was to take place over 2 days, 4–5 November 2023, with the crew overnighting in Townsville, Queensland on 4 November.

Flight plan

The submitted flight plan stated the aircraft would depart Toowoomba Airport and climb to FL280. It would then fly at FL280 overhead Winton, Cloncurry, and Mount Gordon respectively, and conduct aerial work operation (line scanning) near Mount Gordon for a period of 40 minutes. The aircraft was then planned to land at Mount Isa, before travelling on to Townsville later that day (Figure 14).

Figure 14: Planned route

Source: Google Earth, annotated by the ATSB

Fuel 

The aircraft had been refuelled on 3 occasions in the 3 days prior to the accident and had flown about 5 hours. However, the quantity of fuel on board the aircraft when the accident flight departed could not be determined from the records available. 

AGAIR line scanning 

History of line scanning operations

AGAIR commenced line scanning operations around early 2022, following the fitment of the TK-7 Overwatch camera to VH-HPY. VH-HPY was the only aircraft within the AGAIR fleet equipped to undertake the activity. The service was initially provided on an ‘ad-hoc’ basis and in 2023 AGAIR secured a ‘call when needed’ contract with QFES. The AGAIR COO operated as pilot in command of all AGAIR line scanning flights until the pilot of the accident flight commenced operations in September 2023.

Line scanning procedures

The AGAIR OM contained a generic section on aerial photography, but it did not contain specific procedures for the conduct of line scanning operations. 

The pilot of the accident flight had developed draft line scanning procedures for inclusion in the AGAIR OM. These procedures contained a section on tasking, which included information on the altitude line scanning operations were to be conducted. It stated:

The altitude missions are flown will depend on mission specifics. As a general guide for missions where a high coverage area is priority, the preference is to conduct scans as high as possible. This will ensure maximum coverage from the system while minimising the requirements for a high number of passes.

The tasking process will require refining with the clients’ requirements for considerations of weather and terrain. The imagery is affected by cloud and therefore this will dictate what height is feasible for the best product. 

Generally, F200 to F280 is the most effective for large area coverage imaging. The lowest feasible altitude is 5000 ft AGL though this will be dependent on the size of the area. Large areas at this level will require a high number of passes and produce a very large volume of data.

The pilot of the accident flight had emailed the draft procedures to the AGAIR COO on 10 October 2023, but they were not incorporated into the AGAIR OM at the time of the accident.

Line scanning practices

The normal flight profile, as explained by senior AGAIR management personnel, was for line scanning operations to be conducted at FL200‍–‍FL280 as the resolution of the thermal images was not impacted by increased altitude. Consequently, the higher the aircraft flew the greater the swath[27] of the images and the more ground area could be captured in one pass, resulting in increased efficiency of data acquisition.

However, thermal imagery could be affected by cloud and, depending on the cloud coverage, may require the aircraft to descend below cloud level to conduct imaging. In those scenarios, the lower limit for the operation of the camera was about 5,000 ft. 

The ATSB was advised by the AGAIR COO that transit flights to and from the fire area could be flown at any level, but transiting at FL280 would result in improved fuel efficiency in comparison to lower levels. The aircraft was also used for low level ‘birddog’ activities, where it was flown less frequently at higher altitudes.

A review of VH-HPY flights into or out of Toowoomba Airport over the period 4 September 2023–4 November 2023 indicated that 70% of flights involved a cruise at FL280. Since commencing operations with AGAIR, the pilot of the accident flight had flown 24 flights in VH-HPY as PIC, 19 of which were flown at FL280.

Operations at high cabin pressure altitudes

AGAIR chief operating officer actions

During interview, the AGAIR COO stated that they occasionally experienced the intermittent defect with VH-HPY’s pressurisation system while conducting line scanning operations. They recalled 2 occasions where they had continued the climb while the pressurisation system was defective and used oxygen.

The earlier event occurred about 12 months prior to the accident, where the COO recalled continuing the climb while the pressurisation system was defective. They recalled using the aircraft oxygen system, attaining the cruise level, and rectifying the defect by increasing the cabin heat.

The most recent example occurred on 27 October 2023, 8 days prior to the accident, during a line scanning flight from Toowoomba with the COO, as pilot in command, and camera operator 2 on board. The COO used their phone to video the cockpit indications of the defect. The video captured the aircraft in cruise at FL280, with a cabin differential of 2.2 psi and a cabin altitude of about 19,000 ft (Figure 15). There was no audible cabin alarm on the video’s audio.

Figure 15: Inflight cockpit indications captured on video footage 27 October 2023

Source: ATSB

The COO stated that, on that occasion, the pressurisation system defect had manifested during climb, but they elected to continue to their cruise altitude of FL280 as they hoped the system would rectify itself after a short time. They stated that they maintained FL280, while using the aircraft’s emergency oxygen system as a supplemental oxygen supply, for a period of about 20 minutes before the pressurisation system ‘probably’ started working again. They also stated that they silenced the cabin altitude alerting system using the inhibit button located near the power levers. The defect was not entered in the aircraft’s maintenance release, but the occurrence was communicated directly to the maintenance provider via text message with the accompanying video (see also Recent maintenance).

The text message sent from the COO to the maintenance provider included the statement:

this was at F280 with a cabin of F200 and diff 2.2, O2 will need a top off please sir [emoji], got the job done

The COO provided line scanning training to the pilot of the accident flight in late September 2023. The COO recalled that they experienced the pressurisation defect during one of these training flights, and in that instance, they stopped at FL160 until the system functioned correctly. They recalled the advice they gave the pilot of the accident flight on the management of the pressurisation system defect was to ‘do what’s sensible and safe’. 

Pilot of the accident flight actions

Documents sourced during the investigation indicated that the pilot of the accident flight had operated VH‑HPY at a cabin altitude that exceeded FL140 on several occasions. The documentation included:

• An email sent by the pilot of the accident flight on 16 October 2023 to the AGAIR COO stated:

HPY pressurisation stuck on 2.0 differential again for prolonged period.  We needed F280 to complete the trip and thus used a bit of Oxygen.   Pretty normal for HPY as we discussed and the pressurisation has generally been good. Oxy is still good, but we may need to do this profile again on and off.   We have checked with [provider] and he has Oxygen if and when we need it. Is there anything specific re filling Oxygen on HPY that I need to be aware of? Aiming to run it down to below 500 psi and then taxi to [provider] and take it back up to around 1300-1500psi.

On the same day, the AGAIR COO replied to the pilot of the accident flight’s email, stating that they would send the pilot the relevant process from the maintenance manual so that it could be given to the maintenance provider in Toowoomba. The aircraft’s oxygen cylinder was refilled on 18 October 2023 (see Recent maintenance)

• An operational risk assessment (ORAT) was completed by the pilot of the accident flight on 2 November 2023 for a flight that took place on 16 October 2023. This ORAT likely related to the flight referred to in the email sent by the pilot on 16 October 2023 (see the above dot point). The ORAT stated:

Pressurisation stuck on 2.0 differential for extended period. F280 required for mission completion. Oxygen used. Not abnormal and pressurization returned to regular differential after 3.0 hour. 

The ORAT was a tool used by AGAIR flight and operations crew to assess the risk associated with any assigned flight duty or task. The procedures for the use of the tool stated that ‘flight crew shall use the ORAT for all day-to-day operations’. The ORAT for the flight on 16 October had been assigned a total hazard score of ‘4 – normal operations’ and there was no accompanying safety report submitted (see Safety management system). It had been allocated to the AGAIR head of flying operations (HOFO) for approval. Records indicate the HOFO accessed and approved the ORAT on the evening of 6 November 2023. 

• An email sent by the pilot of the accident flight on 22 October 2023 to the AGAIR COO, copying in the AGAIR HOFO, included the following statement:

Pressurisation - No change. Same cycles and fixes. The issue is that we are spending most of our time at F280. This means in a 80 hour month (last month), the accumulative effect of high cabin altitudes is a factor. Both myself and [camera operator 1] have had some symptoms during this rotation. This is mitigated by use of Oxygen, lower altitudes when able and the usual fixes of climbing and descending etc. However given the rate of effort and the altitude, the risk of decompression sickness and hypoxia should not be normalised. As we all know if the diff gets stuck at 2.2 then you generally spend around 90 mins at Cabin Alt of 19000 if F280 is mission essential. This can be mitigated operationally if we can’t fix the pressurisation.

• On the same day, the AGAIR HOFO responded to the pilot of the accident flight’s email stating:

Thanks [name of pilot of the accident flight] for the update. Yes, QFES have definitely embraced the program and are utilising the service well. Many thanks to you and [name of camera operator 1] for keeping it going over the last few weeks. We are getting great feedback and preparing for sustained operations over the summer.

The AGAIR COO did not respond to the pilot of the accident flight’s email.

AGAIR head of flying operations actions

The AGAIR HOFO, who was also the CEO and HAAMC, occasionally flew VH-HPY and had experienced the pressurisation defect for themselves.[28] The HOFO recalled that, in these circumstances, they ceased the climb and flew the aircraft at a lower level. The HOFO had not recorded the defect with the pressurisation system in the aircraft maintenance release following these flights, and they could not recall why they had not done so.

During interview with the ATSB, the HOFO stated that, in the event that the pressurisation system became defective, they had instructed pilots to cease the climb and operate at a safe level. They stated that they were not aware of any pilots that had continued to operate VH-HPY at FL280 with the pressurisation system defective. 

When queried about the email sent by the pilot of the accident flight on 22 October 2023, which detailed the continued operation at FL280 with a cabin altitude of 19,000 ft, the HOFO stated that they had read the pilot of the accident flight’s email as being what ‘would’ happen, rather than what ‘was’ happening. Other than the short email response from the HOFO, where they thanked the pilot and camera operator for ‘keeping it going over the last few weeks’, the HOFO did not contact the pilot to discuss the content of the email. The HOFO explained this was because they were not involving themselves into the operational aspects as they had passed the day-to-day management of the line scanning operation to the AGAIR COO, and that the pilot of the accident flight reported to the COO (see Organisational information). 

Documents sourced during the investigation indicated that the HOFO had attempted to acquire a supplemental oxygen system from a supplier on 22 October 2023. The initial enquiry to the supplier stated:

We are doing high altitude (28,000 ft AGL) operations in our Turbine Commander aircraft where we are spending 4 to 5 hours at this altitude. The aircraft is pressurised but the cabin altitude can be 10,000 feet or more so we are looking for a simple portable system to supplement oxygen for a crew of two. We would like to utilise the existing built in oxygen system in the aircraft and optimise the flow to get maximum time between needing to refill the aircraft bottle. Are you able to help us with this?

On 31 October 2023, the HOFO requested the supplier provide:

one Aerox portable oxygen complete setup – 2 users – E cylinder please. Could you include 6 canulas and one pulse oximeter

The accident occurred before the equipment was supplied. The HOFO subsequently ‘postponed’ the request on 9 November 2023.

Camera operator 1 information

Camera operator 1 had communicated to their family, during casual conversation, that there was an issue with VH-HPY’s pressurisation system that would occasionally manifest. They informed their family that the aircraft had oxygen on board, and they had ‘workarounds’ to deal with the issue.

Historical flight track data

The TrackPlus data for VH-HPY over the period 26 March 2022–2 November 2023 was analysed to identify similar flight profiles to the accident flight. A total of 132 flights took place within this period. Flights with a possible operational requirement were excluded and 8 flights were identified as involving a similar unexplainable descent to a lower flight level for a short period of time before returning to a cruise altitude. The first of these flights took place on 30 September 2023. The pilot of the accident flight was the PIC of 7 of the flights, the COO was the PIC of the eighth flight on 24 October 2023 (Table 5).

Table 5: Previous flight profiles similar to the accident flight were identified from 30 September 2023 to 24 October 2023

Date	Pilot in command	Flight time	Profile
30 Sep 2023	Pilot of the accident flight	2 hr 50 min
15 Oct 2023	Pilot of the accident flight	4 hr 14 min
16 Oct 2023	Pilot of the accident flight	5 hr 27 min
19 Oct 2023	Pilot of the accident flight	4 hr 54 min
20 Oct 2023	Pilot of the accident flight	4 hr 57 min
21 Oct 2023	Pilot of the accident flight	5 hr 30 min
22 Oct 2023	Pilot of the accident flight	3 hr 12 min
24 Oct 2023	AGAIR COO	4 hr 50 min

Aerodynamic stalls and spins 

Aerodynamic stalls

Overview

An aerodynamic stall is a rapid decrease in lift and increase in drag caused by the separation of airflow from the wing’s upper surface. A stall occurs when the angle of attack[29] exceeds the wing’s critical angle of attack,[30] resulting in the disruption to the smooth airflow over the wing. 

Accelerated stalls

At the same gross weight, configuration, centre of gravity location, power setting, and environmental conditions, an aircraft will consistently stall at the same airspeed provided the aircraft is at +1 g.  However, the same aircraft will stall at a higher airspeed when subject to an acceleration greater than +1 g. This type of stall is called an ‘accelerated stall’, and they may occur inadvertently during an improperly executed turn or a pullout from a steep dive (US Federal Aviation Administration 2021).

Accelerated stalls tend to be more aggressive than unaccelerated +1 g stalls and may put the aircraft in an unexpected attitude. Failure to execute an immediate recovery may result in a spin or other departure from controlled flight(US Federal Aviation Administration 2021).

Aerodynamic spins

Overview

An aerodynamic spin is a sustained descent in which one or both of an aircraft’s wings are in a stalled condition. During a spin, an aircraft rotates around its vertical axis affected by different lift and drag forces on each wing, descending due to gravity, rolling, yawing, and pitching in a corkscrew path (US Federal Aviation Administration 2021). A spinning aircraft will descend more slowly than one in a vertical or spiral dive and it will have a lower airspeed, which may oscillate. The pitch angle can also vary considerably from significant pitch down to a relatively flat attitude. 

Entry, development and recovery

A spin may be entered intentionally or unintentionally, from any flight attitude if the aircraft has sufficient yaw while at the stall point. An aircraft may yaw for a variety of reasons including incorrect rudder application, adverse yaw created by aileron deflection, engine or propeller effects, and windshear (US Federal Aviation Administration 2021).

Initially the aircraft will enter an incipient spin phase where the aircraft starts rotating, but aerodynamic and inertial forces have not achieved a balance. This phase may take 2–4 turns to develop as the airspeed slows and stabilises (Figure 16). A fully developed spin occurs when the aircraft’s angular rotation rate, airspeed and vertical speed are stabilised in a flight path that is nearly vertical and the spin is in equilibrium (US Federal Aviation Administration 2021).

Recovery from a spin occurs when rotation ceases and the angle of attack of the wings is decreased below the critical angle of attack. To do so, a pilot is required to apply control inputs to disrupt the spin equilibrium (US Federal Aviation Administration 2021). 

Figure 16: Spin development and recovery

Source: US Federal Aviation Administration (2021)

Gulfstream Commander 695A spin recovery 

The Gulfstream Commander 695A POH prohibited intentional spinning and stated that no spin tests had been conducted. Certification standards for this class of aircraft do not require spin testing to be conducted. However, the POH did contain instructions for recovery should the aircraft inadvertently enter an incipient spin. It stated:

If a spin is entered inadvertently, immediately move control column full forward, apply full rudder opposite to the direction of the spin and reduce power to FLT IDLE. These three actions should be done as near simultaneously as possible. Hold this control position until rotation stops, then neutralize all controls and execute a smooth pullout. Ailerons should be neutral during recovery. Airspeed may reach VMO before full recovery.

Despite this guidance, the relatively large lateral/polar moment of inertia created by the wing‑mounted engines during a fully developed spin would make recovery of the aircraft inherently difficult and possibly improbable.

Telecommunications 

General

All telecommunications made and received by Airservices Australia were recorded. Information related to telecommunications made by other parties was sourced from mobile devices, carrier data and interviews.

Telephone call – pilot and a family member

At 1102, while the aircraft was on climb to FL280, the pilot returned a missed telephone call that they had received from a family member 13 minutes earlier. The AGAIR OM stated that mobile phones could only be used by the pilot during the cruise phase of flight. The return call lasted 3 minutes and 30 seconds. The family member recalled that during the call the pilot sounded focused, happy and logical. Before ending the call, the pilot advised they would call the family member again once they landed. 

Telephone calls – pilot and Airservices Australia personnel

At 1337:46, the Airservices Australia air traffic management director (ATMD) attempted to contact the pilot via mobile phone, however the call went unanswered. At 1338:36, the pilot returned the ATMD’s call, and they had a short conversation that lasted 34 seconds (Table 6). 

Table 6: Transcript from the recording of telephone conversation between the pilot and the ATMD 

Source: Airservices Australia

At 1340:15, the ATMD attempted to call the pilot’s mobile phone again, but the pilot did not answer. The ATMD left a voicemail message stating:

Hi [pilot of the accident flight’s name]. Could you ring air traffic control back again please. [Name of pilot of the accident flight] please ring air traffic control back again on this number. Check your oxygen, oxygen, oxygen, oxygen.

The pilot did not return the ATMD’s call.

Telephone call – Airservices Australia personnel and the AGAIR head of flying operations

At 1350, the ATMD contacted the AGAIR HOFO by phone to advise that ATC had lost contact with VH-HPY, and they suspected the pilot may be suffering from hypoxia (see Appendix B – Transcript – Telephone call between Airservices Australia personnel and the AGAIR head of flying operations).

The conversation lasted nearly 6 minutes during which the ATMD passed the telephone handset to the shift manager (SM), who discussed ATC’s concerns regarding the loss of communications, the pilot’s ‘slow response’ via telephone, the aircraft diverging from track, the ATC ‘oxygen’ calls, and ATC’s instructions for the aircraft to descend. The HOFO was placed on hold for a total duration of 66 seconds. During the conversation ATC regained communication with the pilot and the HOFO was advised that contact had been re-established. The HOFO was also advised that the pilot had confirmed operations were normal and that ATC believed the aircraft was safe.

During the phone conversation, the HOFO advised ATC that the aircraft was on flight tracking, confirmed the level of the aircraft as expected, advised ATC that they believed the flight looked normal, and asked if there were any communication issues in the area. The HOFO did not advise the ATMD or SM that the aircraft had a known intermittent pressurisation defect. The HOFO advised the ATSB that it did not occur to them to pass this information on during the telephone call.  

During interview with the ATSB, the SM stated that their perception of what was going on may have changed had information such as a history of problems with the aircraft pressurisation or about the pilot had been communicated during the telephone conversation.

Speech analysis from the accident flight 

General

As part of the investigation into a Beechcraft King Air 200 accident in 2000, the ATSB obtained expert analysis to determine whether that pilot’s speech and related behaviour was affected by hypoxia (see Related occurrences). A review of research conducted as part of that investigation found that pilots experiencing hypoxia will have a slower speech rate (syllables per second), a slower response time to ATC transmissions, a slowing of the pilot’s coordination of microphone pressing/speaking (in which the pilot allows more ’dead’ time on the radio channel before and after speaking), and slurring of speech. 

There is also a tendency to activate the microphone without speaking, particularly when more adversely affected, and eventually stop responding. Although the fundamental frequency of speech (or pitch) can be an indicator of workload or stress, there is evidence that it tends to remain unchanged in situations involving hypoxia.

During the investigation into the accident involving VH-HPY, the ATSB requested a speech analysis expert, who had previous experience conducting analysis of hypoxia events, conduct an examination of the pilot’s speech and related behaviour during the accident flight to determine if the pilot was affected by hypoxia. The analysis involved comparing the pilot’s communications at lower altitudes against their communications at higher altitudes. 

The analysis used both subjective and computational evaluations of the speech samples. Subjective evaluation provided observations of operational errors, quality and clarity of speech, and the number of syllables spoken. Computational evaluation was used to measure response time to ATC transmissions, the time from the commencement of transmission to the commencement of speech, speaking rate (syllables per second), and fundamental frequency (or pitch).

The speech samples used to perform the analysis consisted of:

• 5 radio statements made by the pilot at lower altitudes 
  (3 below 10,000 ft on the initial climb and 2 at FL150 after the first descent)[31]
• 20 radio statements made by the pilot at higher altitudes[32] 
  (4 at FL280 in first cruise, 2 on climb to second cruise and 1 just after establishing the second cruise at FL280, and then 13 from 55 minutes later at FL280 during the second cruise).

Analysis

The analysis found that, compared to when at lower altitudes, at higher altitudes, the pilot:

• took significantly longer to respond to ATC communication (2.9 seconds compared to 1.1 seconds)[33]
• spoke at a significantly slower rate (5.9 syllables per second compared to 7.4 syllables per second)[34]
• took slightly longer to begin speaking after they commenced a transmission (0.59 seconds compared to 0.26 seconds)[35]^,[36]
• displayed no change in their average speech fundamental frequency (99.6 Hz compared to 99.8 Hz)
• made operational errors, especially in their later communications, such as providing a callsign twice, failing to provide a callsign, and referring to an incorrect location
• spoke unclearly, especially in their later communications, including stuttering toward the end of their communications (which became pronounced in their final communication). 

During the later series of communications (1341:31 to 1401:23), the pilot’s speaking rate became significantly slower (5.1 syllables per second) than their earlier speech at higher altitudes (7.3 syllables per second).[37] The pilot’s final communication displayed the slowest speech of all their communications during the flight (2.81 syllables per second). There was also one occasion when the pilot appeared to unkey and then rekey the microphone when speaking (1359:26) and one occasion when the microphone was keyed but the pilot did not speak (1400:27). 

There appeared to be some improvement in the pilot’s speech while the aircraft spent a short time at FL150 compared to their speech during the initial cruise at FL280, with a more rapid response to the controller, a more rapid response after commencing transmission, a faster speaking rate, and clear and accurate communication. However, only limited samples were available to compare these 2 periods. 

The analysis concluded that the speech samples provide evidence of significant and progressive impairment once the pilot reached FL280, including errors, slowed responses, misarticulations and, eventually, a failure to respond. Overall, the analysis determined that, although the pattern of symptoms could be consistent with a variety of environmental and medical issues, their correlation with altitude strongly indicated impairment by hypoxia.

Air traffic services 

Overview

Airservices Australia was the responsible authority for the provision and administration of civil air traffic services in Australia. The stated objectives of the organisation’s air traffic services, as contained in the Manual of Air Traffic Services,[38] were to: 

a) prevent collisions between aircraft;

b) prevent collisions between aircraft on the manoeuvring area and obstructions on that area;

c) expedite and maintain an orderly flow of air traffic;

d) provide advice and information useful for the safe and efficient conduct of flights; and

e) notify appropriate organisations regarding aircraft in need of search and rescue aid, and assist such organisations as required.

Service types

Airspace in Australia was separated into different classes that were either controlled (class A, class C, class D, and class E) or non-controlled (class G). Different services were offered to aircraft that operated in these airspace classes, based on the flight rules the aircraft was operating under. These services included ATC (en route, approach, and aerodrome), flight information, and alerting. These services were provided by air traffic controllers located at specific aerodromes or 1 of the 2 air traffic control centres located in Melbourne, Victoria and Brisbane, Queensland.

At the time of the accident, the aircraft was operating in class A airspace and received an en route control service from a controller located in the Brisbane ATC centre. 

Airspace

Brisbane Centre was responsible for providing air traffic services to aircraft operating within the Brisbane flight information region (Figure 17). The Brisbane airspace was further divided into smaller volumes of airspace, called regions, with assigned air traffic controllers. 

Figure 17: Flight information regions

Source: Airservices Australia, annotated by the ATSB

While the aircraft was on climb to its cruise level of FL280, the aircraft transitioned into an area of airspace defined as the ‘Simpson’ region, where it spent the remainder of the flight. The Simpson region covered an area of about 2 million km² from the ground level to FL285. Its border started about 160 km inland from the east coast of Queensland and included central and north Queensland, parts of the Northern Territory, and sections of the Torres Strait (Figure 18). 

Figure 18: Brisbane flight information region (Simpson region airspace highlighted)

Source: Airservices Australia, annotated by the ATSB

The airspace was ‘dynamic’ and could be divided into smaller sectors, depending on the volume or complexity of aircraft traffic, with a controller assigned to each sector. Within the region, the lower level of class A and class E (controlled) airspace was FL245 and FL125 respectively. 

At the time of the accident, the air traffic activity within the Simpson region was low, and the airspace was ‘fully combined’ meaning the whole of the Simpson region was being controlled by one controller. 

Also present within the Brisbane Centre at the time was a shift manager (SM), who was responsible for the oversight of the Simpson region’s controllers, and the air traffic management director (ATMD), who had overall responsibility for both the Brisbane and Melbourne airspace.

Air traffic control personnel

Simpson region air traffic controller

There were 2 air traffic controllers who managed VH-HPY while it was within the Simpson region airspace:

• controller 1 had responsibility for the region for 90 minutes and managed most of the loss of communications and hypoxia response
• controller 2 had responsibility for the region for 15 minutes during the period while controller 1 was in break.

All references to the ‘Simpson region controller’ contained herein refer to controller 1. They joined Airservices in 2012 and had about 9 years experience as an en route controller, all within the Brisbane Centre. 

Shift manager

The SM joined Airservices Australia in 2004. Their experience included about 7 years as an area radar controller, 2 years as an operations manager, and 9 years as a SM.

Air traffic management director

The ATMD’s experience included about 27 years as an en route controller, 3 years as a SM, 2 years as an operations manager, and 1 year as an ATMD. 

Emergency phases

Emergency phases were declared by ATC in instances where there was concern for the safety of an aircraft and its occupants. The procedures for the declaration of emergency phases for aircraft were contained in the Manual of Air Traffic Services and included:

• An uncertainty phase (INCERFA) which was declared by ATC when uncertainty existed as to the safety of an aircraft and its occupants. The scenarios under which an INCERFA could be declared included a failure of a pilot to report to ATC 30 minutes after being assigned a frequency change.
• An alert phase (ALERFA) which was declared when apprehension existed as to the safety of an aircraft and its occupants. 

Emergency phases could be upgraded when air traffic control became ‘aware of additional factors that warrant greater apprehension’. This included:

• following an uncertainty phase declared because of failure to report, subsequent communications checks or inquiries to other relevant sources fail to reveal any news of the aircraft; [or]

• information has been received which indicates that the operating efficiency of an aircraft has been impaired to the extent that the safety of the aircraft may be affected.

If an aircraft was subject to an ALERFA declaration and the situation was relieved, but not to the extent that normal operations had been resumed, ATC could downgrade the ALERFA to an INCERFA.

If an aircraft was subject to an emergency phase and had resumed normal operations, or had landed safely, then ATC would cancel the phase and advise relevant units and agencies.

Hypoxic pilot procedures

The procedures to be applied by ATC in the case of specific in-flight emergencies were contained in the Airservices In-Flight Emergency Response (IFER) checklist. This included the actions to take if ATC suspected a pilot was potentially impacted by hypoxia.

The IFER checklist for a suspected hypoxic pilot scenario included the information to be passed to the pilot, the actions to take should escalation be required, and the instructions to issue the pilot to initiate a descent (Figure 19).

Figure 19: Airservices Australia IFER hypoxia checklist

Source: Airservices Australia

Supplemental procedures associated with all types of in-flight emergencies were also contained within the ‘normal operations resumed’ section of the Airservices Australia IFER Management Abnormal Operations manual. This section stated:

Extensive experience, both in Australia and overseas, shows that crews often try to down-play problems when communicating with [air traffic control]. Furthermore, what may be normal as far as the crew is concerned may still preclude the operational system from operating normally.

This section also stated:

If there is the slightest doubt about the continuing safety of the aircraft, it is prudent to continue with the IFER even if at a low key.

Airservices noted this manual was considered training material and reported that controllers do not use it when they are plugged into the console, rather, they only use the IFER Checklist.

Simpson region controller divided attention

Between 1357:43 and 1401:36, the pilot repeated the clearance from the controller 4 times, and twice requested confirmation that the Simpson controller had copied their clearance readback. During this time the Simpson region controller recalled that a lot of activity took place in the vicinity of their console to do with the previously-held concerns for the aircraft’s safety. This included questions from those located near the console. Additionally, during that 3 minute 53 second period there were 3 transmissions made by 2 other aircraft within the Simpson region. The controller responded to both aircraft without delay.

Organisational information

General

At the time of the accident, AGAIR held an air operator’s certificate issued by CASA on 19 May 2020, valid until 30 November 2023, which authorised ‘charter operations’ (CASR part 135) and ‘aerial work operations’ (CASR part 137 and 138). It also held a CASR part 141 flight training certificate that was valid until 28 February 2025. 

AGAIR operated a mixed fleet of aircraft that comprised 3 Gulfstream 690 and 695, 2 Cessna C525, 9 Air Tractor AT802, a Cessna C337 and a Beech Baron. Its main base of operations was located at Stawell Airport, Victoria. AGAIR also had an aerial application (crop spraying) base located at Hay Airport, New South Wales (NSW).

AGAIR provided aerial application services to south-western NSW. It also had contracts to provide aerial services to fire agencies in Queensland, NSW and Western Australia. AGAIR engaged a mixture of permanently‑employed and seasonal pilots to complete aerial application and aerial fire operations.

Organisational structure

The chief executive officer (CEO) was the sole owner of the organisation. In addition to the CEO role, they also held the CASA‑approved positions of head of flying operations (HOFO) and head of aircraft airworthiness and maintenance control (HAAMC). The CEO worked from the AGAIR base at Stawell Airport. The approved organisational structure was documented in the AGAIR operations manual (OM) (Figure 20). 

Figure 20: AGAIR organisational structure

Source: AGAIR

The AGAIR organisational structure depicted all flight crew reporting to the head of training and checking. However, this role was vacant at the time of the accident, as was the head of operations (flight training) position. The CEO stated that the organisation did not have an approved training and checking system, and that they (as HOFO) were undertaking aspects of the role until the organisation received its approval. However, neither the unapproved nature of the training and checking system or the additional training and checking activities undertaken by the HOFO were captured in the AGAIR OM.

The defined responsibilities of the HOFO included:

• The implementation of company policy and ensuring that all company air operations are conducted in full compliance with the Civil Aviation Act 1988, CASRs and CAOs

• Monitoring operational standards, maintaining training and checking records and supervising the training and checking of flight crew

• The allocation of aircraft appropriate to the planned task

The AGAIR OM also stated that the HOFO ‘in exercising any responsibility may delegate to other members of the company certain duties’. The CEO/HOFO stated that they had passed operational control of the line scanning activities to the chief operating officer (COO). This included flight crew reporting, and that the pilot of the accident flight reported to the COO at the time of the accident. This was not reflected in the approved organisational structure, and the AGAIR OM did not contain defined responsibilities for the COO role. 

During interview, the COO confirmed their role included the oversight of the line scanning operations in VH-HPY, which involved overseeing the installation and testing of the camera equipment, mission planning, and client management. 

Safety management system

Introduction

CASA defined a safety management system (SMS) as:

…a systematic approach based on managing risk through setting goals, capturing data, measuring performance and system refinement for managing safety risks. An SMS is woven into the fabric of an organisation that enables effective risk based decision-making processes across the business where risks are identified and continuously managed to an acceptable level.

At the time of the accident, AGAIR was required to have submitted an SMS implementation plan to CASA, but it was not required by aviation legislation to have an approved SMS or safety manager (see SMS implementation). 

Outsourced safety management function

At the time of the accident, AGAIR outsourced its safety management functions to an entity named AVIARC. It provided AGAIR with a nominated safety manager and oversaw the development, implementation and ongoing management of the SMS. This contractual arrangement commenced in mid-2021. 

The nominated safety manager was located at the AVIARC office in Red Hill, Queensland. They attended the AGAIR Stawell and Hay bases about 2 times a year, with most of the safety management work undertaken remotely. An online database, which was accessible by AGAIR and AVIARC personnel, was used for occurrence reporting and the ongoing management of safety functions.

SMS implementation

On 25 November 2022, AVIARC, on behalf of AGAIR, submitted a nomination for a safety manager, safety management manual (SMM) (issue 1 revision 1 dated November 2022), and SMS implementation plan to CASA. At the time of the accident, neither the SMM nor the nomination for safety manager had been assessed by CASA. CASA stated that no assessment had taken place as neither were required to have been submitted. Additionally, AGAIR had not specifically applied to be an early SMS adopter or completed the appropriate application submission for the approval of the safety manager.

The implementation plan submitted to CASA outlined the phased implementation of the SMS. In the supporting letter to CASA, the nominated safety manager stated that:

the Agair Safety Management System is ‘Present’ and ‘Suitable’ in every aspect, and also ‘Operational’ and ‘Effective’ in many others. 

The AGAIR SMS implementation plan did not contain specific timeframes for the implementation of each phase other than to state:

the entire plan may take several years to reach full implementation.

The most recent revision to the AGAIR safety management system took place in June 2023 (SMM issue 4 revision 1), and this version was implemented at the time of the accident. 

System effectiveness

Overview

The ATSB reviewed the AGAIR SMS as implemented at the time of the accident. This involved the review of safety data recorded over the period 2019–2023. Although it was found that AGAIR did have the basic elements necessary to capture and manage operational hazards at the time of the accident, many of these elements were partially implemented, did not meet current defined safety objectives, or contained deficiencies that may have impacted system efficacy. 

The nominated safety manager stated that they were unaware of the intermittent pressurisation defect with VH-HPY, or the practice of operating the aircraft at a hazardous cabin altitude. The AGAIR CEO/HOFO confirmed that they had not raised the pressurisation issue with the safety manager either directly or during the various safety management meetings.

Safety management meetings

The AGAIR SMS had 4 levels of safety meetings:

• executive safety review meetings
• safety action group meetings
• base safety meetings in both Stawell Airport and Hay Airport locations
• CEO touchpoint meetings.

In the 3 years prior to the accident, AGAIR had conducted 14 safety action group meetings, 14 base safety meetings and 8 CEO touchpoint meetings. The minutes from these meetings did not contain any reference to the pressurisation issue involving VH-HPY or the continued risk of operating the aircraft at a hazardous cabin altitude. No executive safety review meetings had taken place. The AGAIR safety manager advised the ATSB that the content of the executive safety review was captured by the CEO touchpoint meetings.

Hazard and occurrence reporting

Interviews with AGAIR personnel and emails sourced during the investigation indicate that at least 8 current or previous AGAIR personnel had awareness of a pressurisation issue with VH-HPY over a period ranging from 1 month to greater than 2 years prior to the accident. Additionally, at least 4 current AGAIR personnel had awareness of the practice of operating the aircraft with an excessive cabin altitude over a period ranging from 1 month to greater than 12 months prior to the accident.

In the 5 years prior to the accident, a total of 62 reports had been submitted into the AGAIR reporting system. Thirty-four of these were work health safety (WHS) or non-operational reports including injuries and infrastructure issues. A total of 28 of the submitted reports related to aviation safety matters including wildlife and airspace issues (Figure 21). There were no instances of either the pressurisation issue or the continued operation of the aircraft with that defect raised within the system. 

Figure 21: AGAIR hazard and occurrence reporting data from years 2019 to 2023

Source: ATSB

The reporting target defined within the AGAIR SMM at the time of the accident was 24 reports per year. However, it was unclear if this target was to also include non-operational reports. Regardless of the composition, this reporting target had not been achieved. A review of CEO touchpoint meeting minutes found that the 2 meetings conducted prior to the accident in September 2023 and October 2023 both referenced a low reporting rate. Other than stating the ‘CEO will encourage pilots to report on issues via usage of the ORAT’ it was unclear what, if any, action had been taken to improve reporting following these meetings. The safety manager had promulgated 4 messages to AGAIR personnel regarding reporting during the period October 2022 to September 2023, but these predated the 2 CEO touchpoint meetings.

During interview with the ATSB, the CEO/HOFO recalled that they always encouraged personnel to submit issues into the safety management system. They also stated that they had not entered the intermittent pressurisation defect into the SMS themselves, nor had they given thought about doing so. During interview with the ATSB, the safety manager stated that both the intermittent defect and the continued operation of the aircraft should have been reported into the SMS.

Hazard register

AGAIR had a hazard register that contained 268 identified hazards across the various activities conducted by the organisation. There were no instances of either the pressurisation issue or the continued operation of the aircraft with such a defect raised within the register. There was also no reference to the operation of pressurised aircraft or line scanning operations within the register.

Internal audits

AGAIR had conducted 19 internal audits in the 5 years prior to the accident. This was composed of 9 WHS or non-operational audits and 10 operational audits. Ninety per cent of the completed audits resulted in no findings and there were no instances of either the pressurisation issue or the continued operation of the aircraft having been identified. No audit of the line scanning operation had been conducted. 

A review of the internal audits by the ATSB found that most of the operational audits were completed by the department owner, for example aircraft fleet audits conducted by the HOFO and HAAMC, in contradiction to the documented procedures contained within the AGAIR SMM current at the time that stated:

the AGAIR SMS audit processes are conducted by persons and departments independent of the functions being audited. … For Internal audits, where an independent auditor is not available, AGAIR can retain the services of a third-party auditor. 

The SMM also stated:

AGAIR uses ‘normal operations’ monitoring methods, to gather hazard information from the normal daily routine workflow. This may include Line Operations Safety Auditing (LOSA), and/or Normal Operations Safety Surveys (NOSS) conducted by the ASM [safety manager] or delegate, on a randomly continuous basis as opportunity arises during the normal course of business.

No LOSA or NOSS had been conducted in the 5 years prior to the accident. 

Management of change

The AGAIR safety management manual current at the time contained procedures for the management of change and stated ‘AGAIR adheres to a policy of systematic change management’. The triggers for the initiation of the change management process included:

• addition of new aircraft type, or more of the same aircraft type

• introduction of new equipment and/or operational procedures

• organisational restructure

• new types of operation

• changes to key personnel

• restructure of operational departments

• acquisition of equipment

• change in customer base.

In the 5 years prior to the accident, no change management activities had been documented. 

Training and education

SMS training was recorded as current for all involved AGAIR personnel at the time of the accident.

Regulatory oversight

Civil Aviation Safety Authority 

Overview

CASA was responsible, under the provisions of Section 9 of the Civil Aviation Act 1988, for the safety regulation of civil air operations in Australia and of Australian aircraft outside of Australia. This included issuing certificates, licences, registrations and permits, and conducting comprehensive aviation industry surveillance. 

The primary means CASA used to oversight authorisation holders[39] were:

• regulatory service activities (for example, assessing applications for the issue or variation to an authorisation holder’s approvals)
• surveillance events.

Surveillance events

CASA undertook surveillance of an authorisation holder to assess the safety performance and compliance with regulatory requirements. This surveillance could be initiated:

• based on a planned schedule
• in response to outside events such as accidents or complaints
• by a regulatory service task
• as part of a national campaign focused on a particular industry sector. 

There were 2 levels of surveillance undertaken by CASA. A level 1 event was usually structured to assess an authorisation holder’s system capabilities. These were large surveillance activities that often took place over several days and involved a multi-disciplinary team. A level 2 event was a less formal activity that was usually shorter in duration and was often focused on the verification of a process in practice. Both levels of surveillance could be conducted onsite or by desktop assessment.

Surveillance events were scoped to assess defined areas of an authorisation holder’s approved activities. Determining the scope of surveillance events incorporated elements of judgment by CASA staff in assessing risk and was informed by a range of information including previous surveillance events, and other safety data related to an authorisation holder. The effectiveness of the associated process(es) would then be assessed using a variety of techniques including process sampling. The limitations of process sampling included that a deficiency could exist within an area outside the defined scope of a surveillance event, that a process might not be sampled to the breadth or depth needed to uncover an issue, or that a process containing an issue might not be sampled at all.

At the conclusion of a surveillance event, CASA would issue a report and any identified findings to the authorisation holder. These findings were classified as:

• safety alerts – used to raise an immediate safety concern regarding a serious breach
• safety findings – used for the purposes of identifying a breach of a legislative provision or a provision of the authorisation holder’s written procedures
• aircraft survey reports – used to provide the registered operator of an aircraft with notice of a potential or actual aircraft defect
• safety observations – used to identify latent conditions resulting in system deficiencies that, while not constituting a legislative or procedural breach, have the potential to result in such a breach if not addressed, or potential areas for improvement in safety performance.

An authorisation holder was required to respond to all findings except for safety observations. If issues identified in a finding were not addressed, the authorisation holder could be subject to regulatory enforcement action, which involved CASA exercising specific legislative powers to alter the legal rights or obligations of the authorisation holder. 

Authorisation holder performance indicator 

The authorisation holder performance indicator (AHPI) tool was an assessment of an authorisation holder completed periodically by CASA. The tool was used until June 2022. The questionnaire covered factors associated with an authorisation holder’s management, organisation, operations, and regulatory history. An overall value was then given, which resulted in the authorisation holder being assigned to either category 1 (higher level surveillance focus required) or category 2 (normal surveillance level appropriate).

AGAIR pre-accident regulatory services

Regulatory service activities of note provided to AGAIR between November 2018–November 2023 included:

• variation to the system of maintenance for VH-HPY (2019)
• renewal of the air operator’s certificate (2020)
• initial issue of a CASR part 141 flight training certificate (2020)
• renewal of the CASR part 141 flight training certificate (2022)
• voluntary suspension of the CASR part 141 flight training certificate (2023).

AGAIR pre-accident surveillance 2018–2023  

Overview

There were 6 AHPI assessments undertaken on AGAIR during 2018‍–‍2022. All assessments resulted in AGAIR being assigned with category 2 (normal level of surveillance appropriate). 

During November 2018–November 2023, AGAIR was also subject to 6 authorisation holder surveillance events (Table 7). This was composed of one level 1 event and 5 level 2 events that included surveillance associated with the variation to the manufacturer’s maintenance schedule for VH‑HPY (January 2019), renewal of the air operator’s certificate (April 2020), and regulatory service tasks. AGAIR had not been subject to any regulatory enforcement action in the 5 years prior to the accident. Further details on 2 surveillance events of note during that period, events 18876 and 18981, are provided in the following sections. 

Table 7: AGAIR surveillance events

Surveillance event 18876 (January 2019)

In January 2019, AGAIR applied to CASA for a one-off approval to vary the validity period for the maintenance release inspection for VH-HPY from 165 hours to 180 hours. At the time of the application, the aircraft had accumulated 6,521.2 hours, with the maintenance release valid for 150 flight hours (up to 6,512.9 hours). However, the maintenance schedule also permitted a non‑cumulative planning tolerance of an additional 15 hours (up to 6,527.9 hours). CASA subsequently granted AGAIR’s request. 

Subsequent CASA review of the maintenance release identified that VH‑HPY had operated 8.3 hours beyond the 150-hour validity period of the maintenance release at the time of the application to CASA and a safety finding was raised. However, CASA acknowledged that the aircraft was still within the 15-hour planning tolerance published in the manufacturer’s maintenance schedule.

AGAIR responded to the safety finding, stating that the organisation had misinterpreted the allowable 15 hour ‘grace’ period within the system of maintenance which required a logbook statement and the maintenance release show the actual expiry time of 165 hours rather than 150 hours. An amended logbook statement for VH‑HPY was provided to CASA in May 2019 and the finding was acquitted by CASA in October 2019.

Surveillance event 18981 (May 2019)

In February 2019, CASA received correspondence from the New South Wales (NSW) Rural Fire Service (RFS)[40] that contained concerns raised by an AGAIR pilot. The concerns raised by the pilot included: 

• ‘numerous ongoing maintenance issues’ with 2 aircraft used by AGAIR,[41] VH‑LVG (an Rockwell Commander 690A) and VH‑CLT (a Rockwell Commander 690B)[42]
• senior AGAIR personnel providing conflicting advice to pilots on the continuation of operations with aircraft defects that (according to the reporting pilot) impacted the safety of operations ‘on a daily basis’
• deferring the rectification of aircraft defects that impacted the safety of operations
• non-compliant flight and duty rostering practices affecting pilot fatigue. 

The concerns raised by the pilot did not contain any information on specific defects, other than reference to an issue with the air conditioning system of VH-LVG, which the pilot indicated had resulted in a very hot and fatiguing cockpit environment and resulting in tablets used as electronic flight bags (EFBs) entering thermal shutdown. 

In response to the raised concerns, CASA initiated an onsite level 2 surveillance event that took place in May 2019. The surveillance was scoped to assess airworthiness control, crew scheduling and authorised activities. The surveillance team was composed of a flying operations inspector (FOI) and an airworthiness inspector (AWI). The surveillance event was conducted over a single day at AGAIR’s Stawell Airport facility and, according to the surveillance report and subsequent interviews with the involved AWI, the event involved:

• interviews with the CEO (chief pilot and HAAMC) and a senior pilot
• a review of flight and duty time records, AGAIR operations manual, and the current maintenance release for VH-LVG[43]
• a non-intrusive, visual inspection of VH-LVG, and an Air Tractor.

The surveillance report, issued to AGAIR, stated:

The aircraft maintenance release for VH-LVG, Rockwell Turbo Commander 690B was reviewed and found to have no defects noted from operating pilots regarding any safety of flight issues. The release appeared to be managed correctly.

As a result of the surveillance, CASA issued AGAIR one safety finding and 3 observations (Table 8). The finding related to flight and duty rest requirements, which was one of the issues the pilot had raised with the NSW RFS.

Table 8: Surveillance event 18981 findings

The ATSB reviewed the surveillance file and interviewed the AWI who undertook the May 2019 surveillance activity. The surveillance file contained limited information about the planning and actual conduct of the surveillance, and the FOI involved was no longer working for CASA and was not interviewed. 

The AWI recalled that they had not themselves been in contact with the reporting pilot, and was unsure whether others at CASA had done so. There were no records on the surveillance file to indicate whether CASA contacted the pilot who wrote to the NSW RFS to assist in the planning for the event. However, usual practice was for CASA to make contact before any surveillance event was approved, so such a record may not have been stored in the surveillance file. The ATSB was unable to contact this pilot.

The AWI recalled that it was generally the approach that when conducting surveillance activities of authorisation holders that were involved in firefighting activities, the events were scheduled outside of the peak fire season to minimise the operational impacts to the holder from these activities. 

At the time of the surveillance event, the AWI recalled that they had no previous interactions with AGAIR or GAM. Further, the AWI recalled that CASA’s approach to the surveillance was to determine if there was validity to the pilot’s complaint. The AWI advised that both aircraft inspected were in good condition. The historical (expired) maintenance releases and the aircraft logbooks were located at the aircraft’s maintenance provider (GAM) facility at Essendon Airport, Victoria, and were not reviewed. The AWI recalled that there was no evidence from their visit to suggest that there was activity going on that was not being documented, and nothing to indicate additional surveillance was necessary. 

The ATSB was unable to determine if the safety finding related to pilot flight and duty times had been acquitted based on the available records.

ATSB review of VH-LVG maintenance records

The ATSB undertook a review of the maintenance records for VH-LVG from December 2014–April 2023. This included a crosscheck of the information contained within historical maintenance releases and the information contained within the aircraft airframe, engine, and propeller logbooks.

The maintenance release current at the time the AGAIR pilot raised their concerns, very likely the same maintenance release reviewed by the AWI during the surveillance event, contained 2 annotated items within the defects section. Both had been entered by a licenced aircraft maintenance engineer (LAME) on 11 February 2019:

• ‘TRAFFIC PROCESSOR REQ SERVICE’
• ‘RUDDER TRIM IND FLICKERING’. 

These defects had been rectified during unscheduled maintenance endorsed on 15 and 27 February 2019. 

Of the 7 maintenance releases that were valid from December 2014 to May 2019, 5 had no defect entries. Further ATSB examination identified about 10 entries of unscheduled work recorded in the airframe logbook with the characteristics of defects that could have appeared during operations and been identifiable by pilots. It was not determined whether these defects had been knowingly deferred.

This work was carried out during scheduled 150-hourly checks. Most of these defects were minor with the exception of one entry that related to the right engine oil pressure indicating system. 

AGAIR post-accident surveillance 

In response to the accident involving VH-HPY, CASA conducted a level 2 surveillance event (number 28544) of AGAIR in January 2024 at Avalon Airport, Stawell Airport, and Essendon Airport, Victoria. The surveillance was scoped to assess airworthiness assurance and airworthiness control, crew scheduling and authorised activities, and it was completed over 3 days. Personnel from one of AGAIR’s maintenance providers, GAM, were also interviewed as part of the surveillance event. The surveillance team was composed of 2 AWIs. One safety alert, 5 safety findings and 2 safety observations were issued to AGAIR (Table 9).  

The primary issue identified by CASA was AGAIR operating its Gulfstream 690 and 695 aircraft (VH-HPY, VH-LVG and VH-LMC) with known defects not recorded on the maintenance release and operating these aircraft with scheduled maintenance overdue. 

CASA reported that the related findings were primarily supported by evidence from crosschecking the maintenance releases and aircraft logbook certifications. Additional supporting information also included personnel interviews and an internal GAM email record from March 2023 listing numerous defects provided to them by an AGAIR pilot. CASA did not conduct a review of the entire history of each aircraft, but issues were identified for VH-LVG and VH-LMC between the years 2022 and 2023. A more in-depth review was conducted on VH-HPY since it was involved in the accident, and this review identified issues that existed between the years 2018 and 2023. 

AGAIR provided CASA with responses to the safety alert and safety findings. These responses were under assessment at the time of publication.

Table 9: Surveillance event 28544 findings

GAM pre-accident surveillance 2018–2023

There were 3 AHPI assessments undertaken on GAM between 2018 and 2022. All assessments resulted in GAM being assigned with category 2 (normal level of surveillance appropriate). 

Between November 2018–November 2023, GAM was subject to one surveillance event that was conducted in May 2023. The CASA surveillance team was composed of 2 AWIs and one safety systems inspector. The event was conducted onsite at GAM’s Essendon Airport facility over 2 days. Three safety observations were issued to GAM related to non-destructive testing and safety assurance improvements. 

GAM post-accident surveillance 

Following the post-accident surveillance of AGAIR, CASA conducted a level 2 surveillance event (number 28605) of GAM onsite at its Essendon Airport facility over 2 days in April 2024. The surveillance team was composed of 2 AWIs, and the scope included approved maintenance organisation operations, data and documents, and maintenance activity. Six safety findings and 2 observations were raised as a result (Table 10). 

The primary issue that CASA identified was that GAM had not appropriately managed the conduct of aircraft modifications on 2 Gulfstream 695A aircraft. This included the installation of the TK-7 camera system on VH-HPY.

GAM provided CASA with responses to the safety findings. These responses were under assessment at the time of publication. 

Table 10: Surveillance event 28605 findings

Related occurrences

The ATSB occurrence database contained 6 other serious incidents and accidents that were investigated involving pilot incapacitation due to altitude hypoxia.

Pilot incapacitation involving Raytheon Aircraft Super King Air 200, VH‑OYA, 72 km east of Edinburgh Airport, South Australia, on 21 June 1999 (ATSB investigation 199902928)

On 21 June 1999, a Raytheon Aircraft Super King Air 200, VH-OYA, departed Edinburgh, South Australia for Oakey, Queensland with 1 pilot and 2 passengers. One of the 2 passengers, who was also a pilot but not qualified to operate the aircraft type, occupied the co-pilot seat. The other passenger was seated in the cabin. All 3 occupants were serving RAAF personnel.

As the aircraft reached the cruise level of FL250, the controller contacted the pilot, indicating that the aircraft was not maintaining the assigned track. The pilot acknowledged this transmission. A short time later the passenger in the co-pilot seat noticed that the pilot was repeatedly performing the same task to do with GPS programming. The controller advised the pilot again that the aircraft was still off track, however the pilot did not reply to this transmission. Shortly after this, the pilot lost consciousness. The passenger in the co-pilot seat took control of the aircraft and commenced an emergency descent. The other passenger then unstowed the pilot's oxygen mask and took several breaths of oxygen from it before fitting it to the unconscious pilot. Neither passenger donned an oxygen mask during the incident. The pilot recovered consciousness during the descent, and once they had regained situation awareness, resumed control of the aircraft and carried out an uneventful landing.

The investigation concluded that both bleed air switches were inadvertently selected to ENVIR OFF during the climb. It was also found that the cockpit warning system did not adequately alert the pilot to the cabin depressurisation, and the oxygen mask deployment doors were incorrectly orientated during installation so that the masks would not automatically deploy when required. The ATSB also identified that hypobaric training did not provide an effective defence to ensure that the pilot or passengers would identify the onset of hypoxia.

Pilot and passenger incapacitation involving Beech Super King Air 200, VH‑SKC, Wernadinga Station, Queensland, on 4 September 2000 (ATSB investigation 200003771)

On 4 September 2000, a Beech Super King Air 200 aircraft, VH-SKC, departed Perth, Western Australia on a charter flight to Leonora with 1 pilot and 7 passengers on board. Shortly after the aircraft had climbed through its assigned altitude, the pilot’s speech became significantly impaired and they appeared unable to respond to ATC instructions. Open microphone transmissions over the next 8 minutes revealed the progressive deterioration of the pilot towards unconsciousness and the absence of any sounds of passenger activity in the aircraft. No human response of any kind was detected for the remainder of the flight. Five hours after taking off from Perth, the aircraft impacted terrain and was destroyed. There were no survivors.

The investigation concluded that the incapacitation was probably a result of altitude hypoxia due to the aircraft being fully or partially unpressurised and the occupants not receiving supplemental oxygen. Due to the extensive nature of the damage to the aircraft caused by the impact with the ground, and because no recording systems were installed in the aircraft (nor were they required to be), the investigation could not determine the reason for the aircraft being unpressurised, or why the pilot and passengers did not receive supplemental oxygen.

Uncontrolled flight into water involving Cessna 208B, VH-FAY 260 km north-east of Narita International Airport, Japan, on 27 September 2018 (ATSB investigation AO-2018-065)

The pilot of a Cessna 208B aircraft, registered VH-FAY, was contracted by the aircraft operator to ferry VH-FAY from Jandakot Airport, Western Australia to Mississippi, United States. On the morning of 27 September 2018 local time, the aircraft departed Saipan International Airport, Northern Mariana Islands, for a planned flight to New Chitose Airport, Hokkaido, Japan. After climbing for about an hour, the aircraft levelled off at FL220. 

After 2 hours 20 minutes flight time, the pilot contacted Tokyo radio flight information service at the first mandatory reporting position. The aircraft passed the next reporting point at the same altitude, 1 hour 20 minutes later, but the pilot did not contact Tokyo radio as expected. Tokyo radio made repeated attempts to communicate with the pilot, without success. Having received no communications from the pilot for 4.5 hours, 2 Japan Air Self-Defense Force aircraft intercepted VH-FAY. The pilot did not manoeuvre the aircraft in response, in accordance with international intercept protocols. 

After about 30 minutes, the Japan Air Self-Defense Force pilots observed VH-FAY descend into cloud. The aircraft descended rapidly and disappeared from radar less than 2 minutes later. Within 2 hours, search and rescue personnel located the aircraft’s rear passenger door. No other aircraft wreckage was located and the pilot was not found.

The ATSB found that while the aircraft was in the cruise on autopilot, the pilot almost certainly became incapacitated and did not recover. About 5 hours after the last position report, without pilot intervention to select fuel tanks, the aircraft’s engine stopped, likely due to fuel starvation. This resulted in the aircraft entering an uncontrolled descent into the ocean. The cause of incapacitation could not be determined. While a medical event could not be ruled out, the pilot was operating alone in an unpressurised aircraft at 22,000 ft and probably using an unsuitable oxygen system, which increased the risk of hypoxia.

Depressurisation event involving a Metro 3, VH-SEF, 93 km south-south-east of Narrabri Airport, New South Wales, on 23 September 2012 (ATSB investigation AO-2012-127)

On the evening of 23 September 2012, a Metro 3 aircraft, VH-SEF, departed Narrabri, New South Wales on a scheduled passenger flight to Sydney with 2 pilots and 7 passengers. During the climb, the captain began to feel unwell and their symptoms worsened as the climb progressed. The captain used the aircraft’s oxygen supply and noted that their symptoms started to improve. The captain requested the first officer check the cabin altitude, but before they could respond, the cabin altitude warning light illuminated at a cabin altitude of 17,000 ft. An emergency descent to 10,000 ft was subsequently performed.

The flight crew later found that the aircraft’s pressurisation system would not pressurise the cabin in automatic mode, and manual mode resulted in an erratic cabin altitude. Once the aircraft had landed, the pressurisation system was tested with no fault found. The cabin altitude warning switch was found to be out of tolerance and replaced. At the time of the incident, there was no routine maintenance regime for the cabin altitude warning system.

Flight crew incapacitation involving a Reims F406, VH-EYQ, near Emerald Airport, Queensland, on 1 August 2014 (ATSB investigation AO-2014-134)

On the morning of 1 August 2014, a Reims Aviation F406 aircraft, VH-EYQ, departed Emerald, Queensland, on an aerial survey task with a pilot and navigator on board. The aircraft was fitted with an oxygen system to allow unpressurised operations above 10,000 ft. 

During the climb, the pilot turned on the aircraft oxygen supply, and then connected and donned their oxygen mask. The pilot then monitored their blood oxygen saturation level on an oxygen pulse meter as the aircraft continued to climb. During the climb to FL245, at a level of about FL180, the pilot noticed that their blood oxygen saturation level had fallen significantly.

The pilot attempted to increase the amount of oxygen they were receiving, while continuing to climb, by adjusting their oxygen system controller. During this period, the pilot’s accuracy when controlling the aircraft deteriorated and their speech became slurred. The navigator encouraged the pilot to maintain control and descend, and ATC prompted the pilot to ensure they were receiving an adequate supply of oxygen. The pilot eventually identified that their oxygen fitting had disconnected. The fitting was reconnected by the pilot, after which the pilot made a controlled descent before landing at Emerald.

Pilot incapacitation involving Cessna 208B, VH-DQP, near Brisbane Airport, Queensland, on 2 July 2020 (ATSB investigation AO-2020-032)

On the afternoon of 2 July 2020, the pilot of a Cessna 208B aircraft, VH-DQP, was conducting a ferry flight from Cairns, Queensland to Redcliffe. After encountering unforecast icing conditions and poor visibility due to cloud, the pilot climbed from 10,000 ft to 11,000 ft. Later, ATC attempted to contact the pilot regarding the descent into Redcliffe but no response was received from the pilot at that time, or for the next 40 minutes. During this time, ATC, with the assistance of pilots from nearby aircraft, made further attempts to contact the pilot. When the aircraft was about 111 km south-south-east of the intended destination, communications were re-established. The pilot was instructed by ATC to land at Gold Coast Airport. The pilot tracked to the Gold Coast and landed.

The ATSB found that the pilot was likely experiencing a level of fatigue due to inadequate sleep the night before, and leading up to the incident, and consequently fell asleep during the flight. Further, operating at 11,000 ft with intermittent use of supplemental oxygen likely resulted in the pilot experiencing mild hypoxia. This likely exacerbated the pilot’s existing fatigue and contributed to the pilot falling asleep.

Safety analysis

Introduction 

On the morning of 4 November 2023, a Gulfstream 695A, registered VH‑HPY, was tasked to conduct line scanning of fire zones north of Mount Isa, Queensland. On board the aircraft were the pilot and 2 camera operators. 

About 1 hour and 50 minutes into the flight, while the aircraft was in cruise at flight level (FL) 280, air traffic control (ATC) radio contact with the pilot was lost. ATC made multiple attempts to contact the pilot, leading ATC to declare an uncertainty phase for the aircraft. Following a brief telephone conversation with the pilot, where the pilot’s speech was detected to be ‘slow’ and ‘delayed’, ATC upgraded the status to an alert phase and initiated their hypoxia emergency procedures.

About 10 minutes later, radio contact with the pilot was re-established via the crew of a Royal Australian Air Force aircraft, then directly with ATC. The alert phase was downgraded to an uncertainty phase and, a short time later, ATC cancelled the uncertainty phase.

The pilot confirmed with ATC that their oxygen system was operating normally, and they were subsequently issued a clearance to undertake line scanning north of Mount Isa. The pilot made a final radio transmission at 1401:23. Commencing at 1419:19, ATC attempted to repeatedly contact the pilot, but they did not respond to any further radio calls.

At 1426 the aircraft entered a descending anticlockwise turn with an increasing rate of descent. At an altitude of about 10,500 ft, the aircraft likely transitioned into an aerodynamic spin, with a subsequent average rate of descent of about 13,500 ft/min. The aircraft collided with terrain at about 1427, with the wreckage located 55 km south-east of Cloncurry Airport. The 3 occupants were fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed post-impact fire.

This analysis first examines pilot impairment and the accident sequence, and then discusses the maintenance, organisational, air traffic control and regulatory oversight aspects involved.

Altitude hypoxia

The pilot’s speech, as captured by ATC recordings, demonstrated significant and progressive impairment while the aircraft was operating at about FL280. This included errors, slowed responses, misarticulations, and eventually a failure to respond to radio calls.

The pilot’s medical history and the post-mortem examination contained no indications of a pre‑existing medical condition that could have resulted in their impairment. Additionally, camera operator 1 held a commercial pilot licence, with experience flying twin-engine aircraft, and they would likely have been able to operate the aircraft had the pilot experienced a medical event. 

The content of the pilot’s radio transmissions at FL280 were consistent with altitude hypoxia. The vocal symptoms exhibited by the pilot varied significantly with altitude, noticeably improving when the aircraft descended to FL150, then worsening again when the aircraft returned to FL280. These symptoms progressively worsened when the flight was continued at FL280. The pilot’s final radio transmission included an incorrect location reference, stuttering, and the slowest speaking rate of all transmissions.

The effects of altitude hypoxia worsen as pressure altitude increases and over the duration of exposure, and include impairment of cognitive skills, impaired psychomotor coordination, reduced reaction times and loss of consciousness. From the evidence available, further elaborated on below, it is almost certain that during the flight the pilot experienced hypoxia symptoms that degraded their ability to operate the aircraft, and it is possible that the pilot also experienced some loss of consciousness.

The ATSB also identified that the aircraft was likely higher than indicated by the barometric data transmitted by the automatic dependent surveillance broadcast (ADS-B) transponder. During cruise at FL280 it is likely that the actual altitude of the aircraft was at about 29,400 ft, which would have further exacerbated the effects of altitude hypoxia.

Accident sequence

Power reduction

About 4 minutes prior to the accident, when VH-HPY was about 67 km south-east of Cloncurry Airport, the aircraft entered a very shallow descent from FL280, and its airspeed began to decay at a linear rate. Over a period of 2 minutes the airspeed reduced from about 148 to 86 knots calibrated airspeed. 

The flight plan route, and ATC clearance current at the time, was for the aircraft to track to a location near Mount Gordon to undertake line scanning. Both the flight to this location and line scanning were to be conducted at FL280. Consequently, there was no planned operational reason for the aircraft to initiate a descent at the location where the deceleration commenced. 

The linear deceleration, combined with the shallow descent, was estimated to require a reduction in engine power settings to about 25% maximum continuous power (MCP). This value was consistent with the power setting calculated to be used by the pilot earlier in the flight when the aircraft undertook a descent from FL280 to FL150, and significantly less than the 46–48% MCP setting that was calculated to have been used by the pilot during cruise. 

It is possible that, as the aircraft neared Cloncurry, the pilot reduced the power with the intention of undertaking a similar manoeuvre. Overall, there was insufficient evidence to determine why the power levers were reduced during the flight. However, the pilot’s ability to manage the aircraft systems (such as not disengaging the autopilot), or communicate their intentions to ATC, would probably have been impacted by the effects of altitude hypoxia, resulting in the pilot not initiating the descent correctly.   

Departure from controlled flight

The flight data, in conjunction with the wreckage composition and witness observations, indicate the aircraft had entered a stable spin by about 10,500 ft that continued until impact with terrain. 

There was no hazardous weather forecast for the area and the wreckage composition was not consistent with an in-flight breakup with all major components accounted amongst the wreckage at the accident site. While the quantity of fuel onboard the aircraft could not be established, the engine and propeller indications, flight performance data, witness reports, and large post-impact fuel-fed fire were consistent with the engines operating and producing power at impact. 

The aircraft wreckage was surrounded by an undamaged tree and termite mounds, indicating a near vertical trajectory, and the aircraft’s angle of entry was shallow and upright. The aft fuselage was compressed and displaced on the windward side, and the aircraft nose was displaced to the left, indicating clockwise rotation at impact. 

Several possibilities for the aircraft’s departure from controlled flight were examined.

Stall

An aerodynamic stall was examined as a possible mechanism for the aircraft’s departure from controlled flight. However, this scenario was considered unlikely as the calculated stall speed of the aircraft at the time was about 74 kt calibrated airspeed (KCAS), 12 kt less than the calculated airspeed of the aircraft. Additionally, it was calculated that the aircraft engines were producing about 25% MCP, which would effectively decrease the stall speed and result in a further increased margin above the stall. 

Inoperative engine

An inoperative engine resulting in an inability to maintain directional control was also considered and excluded as a mechanism for the departure from controlled flight. While the minimum control speed air (V_MCA) for the aircraft was 95 KCAS, the minimum control speed decreased to approximately 67 KCAS when the 25% MCP engine power was applied to the scenario (assuming half the lateral thrust and thus half the yaw moment). This speed was 19 kt less than the speed of the aircraft. 

Both engines had internal damage indicating they were operating at the time of impact. The damage present on both propellers showed multiple indications that the engines were probably operating at a low to moderate power at the time of impact, further reducing the likelihood of such a scenario. 

Autopilot disengagement

The autopilot trim servo monitor had fault detection and diagnostic capabilities that would automatically disengage the autopilot if it detected an exceedance of threshold voltages within a servo as it worked against an aerodynamic or mechanical force. It is possible that the threshold voltage of the elevator/elevator trim servo was exceeded as the angle of attack increased and, as a result, the autopilot disengaged, and the aircraft began a slow roll to the left. However, no data existed that captured the resistance values within these servos and, consequently, an accurate calculation of the conditions present within the autopilot system could not be achieved. 

Emergency descent

The flight data was consistent with the pilot’s training notes for the execution of an emergency descent which stated, ‘best initiated with roll, using the secondary effect (yaw) to pitch the nose down to the required attitude without causing negative load factor.’ It is therefore possible that the pilot manually disconnected the autopilot and initiated the descent manoeuvre, while managing the effects of altitude hypoxia. It is also possible, albeit less likely, that one of the camera operators may have manually disconnected the autopilot in response to the hypoxic scenario. 

Regardless of the mechanism for the initial departure from controlled flight, the manoeuvre progressed to a high-speed descent with an average vertical speed of about 19,500 ft/min (192 kt vertical). Prior to the aircraft passing 10,500 ft the aircraft transitioned from a high-speed regime to a slow, below stall speed spin. There were 2 scenarios that would likely result in such a transition. They were a pull out of a near vertical dive or spiral dive, without overstressing the airframe to: 

• a climbing attitude allowing the speed to decay to around stall before an uncoordinated entry into the spin; or
• an entry to an accelerated stall due to high ‘g’ acceleration, possibly while attempting to roll wings level. 

The first scenario is unlikely due to there being no evidence of climbing flight in the flight data. 

From an almost certain hypoxic state, with rapid descent into increasing air density and pressure, and with increasing wind noise and possibly airframe buffet, the pilot likely became more aware of their situation and attempted to manoeuvre the aircraft by pulling out of the dive. In a vertical dive pull out, stall speed will increase with normal acceleration. If yaw or roll was present at the time of the stall, it would likely have resulted in the aircraft entering an unintentional spin condition that continued until the aircraft impacted terrain.

Furthermore, being a twin-engine aircraft, spin recovery is not probable due to the relatively large lateral/polar moment of inertia created by the wing-mounted engines. The flight manual contained a section on spin recovery, but it also stated that no spin testing had been conducted.

VH-HPY pressurisation defect and continued operations at high altitude

Pressurisation defect

The aircraft had a pressurised cabin that was designed to permit the aircraft to operate up to a service ceiling of 35,000 ft without the occupants requiring supplemental oxygen. The aircraft was also fitted with an oxygen system, to be used in the event of an emergency such as a cabin depressurisation, that allowed the pilot to make a planned descent to a safe altitude.

However, the aircraft had a known, long-term, unresolved intermittent pressurisation system defect that would occasionally limit the maximum attainable cabin differential to about 2.2 psi. The normal operating cabin differential was about 6.6 psi. The pressurisation defect was known by AGAIR management personnel and pilots, as well as engineering staff at the operator’s maintenance facility (General Aviation Maintenance). This included the AGAIR head of flying operations (HOFO), chief operating officer (COO) and the pilot of the accident flight. While the defect had not been recorded on the maintenance release, nor entered into the AGAIR hazard and occurrence reporting system (SMS), raised at safety meetings or reported to the external safety manager, attempts had been made by GAM engineers to resolve the defect, but these attempts were unsuccessful. 

The defect would manifest during climb, indicated by a low value on the cabin differential gauge, which would give the pilot operating the aircraft the opportunity to cease the climb at a level that would maintain a safe cabin altitude (typically less than 10,000 ft). If the climb was continued, and the cabin altitude exceeded 11,000 ft (± 500 ft), the pilot would be alerted to the unsafe cabin altitude by an aural warning, which could be silenced by the pilot, and a flashing annunciator that would continue for 10–20 seconds and then remain illuminated until the cabin altitude was below the 11,000 ft threshold. In this instance, the pilot’s operating handbook (POH) required the pilot to don an oxygen mask and initiate a descent to 12,000 ft or below.

The POH required the aircraft to be operated unpressurised if a pressurisation system component was inoperative. The aircraft was fitted with an oxygen system, but it was for emergency use only to allow the pilot to make a controlled descent to a safe altitude in the event of a depressurisation or cabin air contamination event. Consequently, with the pressurisation system defective, the aircraft was required by aviation legislation to be operated no longer than 30 minutes continuously between FL125 and less than FL140, or it could be operated indefinitely at a level below FL125.

Pilot actions during previous flights

AGAIR normally conducted line scanning as a single pilot operation along with one camera operator on board. The flights were typically flown at FL280 as it provided for a wide camera swathe and increased fuel economy. Recorded data shows that about 70% of all VH-HPY flights into and out of Toowoomba during 4 September 2023–4 November 2023 involved a cruise at FL280. However, the associated operational procedures (in draft at the time of the accident) permitted line scanning to take place at any altitude at or above 5,000 ft. While management and draft procedures noted FL280 provided the best efficiency for both transiting and scanning, there was no specific requirement for the flights to be conducted only at FL280. 

The pilot of the accident flight undertook their first line scanning flight as pilot in command on 28 September 2023 and flew 24 flights as PIC of VH‑HPY, 19 of which involved a cruise at FL280. Over this period, the pilot sent a series of emails to AGAIR management personnel that described a practice of continuing to operate VH-HPY at FL280 while the pressurisation system was defective. In one such email, the pilot stated that they were regularly spending 90 minutes at a cabin altitude of 19,000 ft while operating at FL280. 

The time of useful consciousness (TUC) at 19,000 ft without a supplemental supply of oxygen could be as low as 18 minutes. To mitigate the risk of hypoxia, the pilot described using the aircraft’s oxygen system for non-emergency use. The oxygen system was designed for emergency use only, and for continuous flight at a cabin altitude of 19,000 ft, the pilot and crew were legally required to use an appropriate oxygen system, that is, a system designed for continued use over the duration of the flight.

The pilot of the accident flight also communicated a practice of conducting brief descents to a lower level as an additional means of managing the effects of hypoxia. A review of flight data revealed that the pilot had conducted similar short descents during 7 flights in the lead-up to the accident. No normal or approved operational requirement for these descents could be established. 

The emails sent by the pilot, and the VH-HPY historical flight data, indicate the pilot had a pattern of normalised deviation from safe operating practices by continuing to operate the aircraft at FL280 when the pressurisation system was defective. However, the pilot was not alone in the practice of continuing to operate the aircraft at FL280 while the pressurisation system was defective (see Organisational influences). These flights were conducted without access to a suitable oxygen supply, significantly increasing the risk of altitude hypoxia induced incapacitation.

The concept of ‘normalisation of deviance’ describes the desensitisation to risk experienced by individuals or groups who repeatedly deviate from safe operating practices, within a high-risk environment, without encountering negative consequences. A prominent feature of the normalisation of deviance is the desensitisation process, where frequent deviant actions result in the practice’s normalisation and perceived standardisation within everyday operations. This sets a new precedent for what is considered tolerable and establishes a new normal from which further deviations may occur. In the absence of intervention (for example, an independent audit), this cycle of deviance is disrupted only when the behaviour results in an undesirable outcome such as an accident (Sedlar and others 2022).

Pilot actions during accident flight

As previously noted, the pilot’s speech and related behaviour while the aircraft was at FL280 demonstrated significant and progressive impairment that was consistent with altitude hypoxia. Within the aviation context, the principal causes of altitude hypoxia are: 

• ascent to high cabin altitude without the use of supplemental oxygen
• failure of the supplemental oxygen system, or oxygen set to an inadequate concentration and or pressure, while at high cabin altitude
• depressurisation of the pressure cabin at high altitude (Gradwell 2016).

In addition, and as previously stated, the pilot of the accident flight had a normalised practice of operating VH-HPY at FL280 with the pressurisation system defective, resulting in a cabin altitude of 19,000 ft. The pilot’s strategies for mitigating the effects of hypoxia during these flights was to undertake descents to lower flight levels for a short period of time and use of the aircraft oxygen system for non-emergency use.

During the accident flight, at about 1141, the pilot undertook a descent to FL150 for a period of about 6 minutes, before climbing back to FL280. The descent was not part of the submitted flight plan and there was no operational reason for the descent to occur. The descent, which was consistent with the pilot’s practice for hypoxia management, almost certainly indicates that the aircraft's pressurisation system did not attain the required cabin altitude.

Although the aircraft cabin altitude at FL280 was not recorded and had not been reported by the pilot during the accident flight, if the aircraft pressurisation system defect manifested as it had done on previous flights, the cabin altitude at FL280 would have been about 19,000 ft. The TUC at 19,000 ft could be as low as 18 minutes, however the aircraft had been in cruise for about 90 minutes when the pilot made their final radio transmission. Although TUC is dependent on individual factors, the extended period beyond the calculated TUC may indicate that the pilot used the oxygen system for non-emergency use during cruise, as they had also done during previous flights.

The oxygen system included 2 rapid-donning masks in the cockpit and drop‑down masks within the cabin. It is unclear how these masks may have been used with 3 occupants on board the aircraft. There was one cylinder that provided oxygen to the cockpit and cabin masks which was refilled during the maintenance activity that took place 4 days prior to the accident. The aircraft had flown 2 flights since the refill so the amount of oxygen contained within the cylinder when the aircraft departed could not be determined. However, assuming the cylinder was at 1,800 psi at the time of departure from Toowoomba Airport, it was calculated that the cylinder contents would be depleted after about 29 minutes if used by 3 occupants, depending on flow rates. 

This time period is significantly less than the time the aircraft spent in cruise at FL280 up to the pilot’s final radio transmission. It is possible that the aircraft cabin altitude was less than 19,000 ft but still within the hypoxic range, or the crew may have been using the oxygen system intermittently, or highly diluted, to manage the acute symptoms of hypoxia. Such a scenario would be highly unsafe as the symptoms and signs of hypoxia, on acute exposure to altitudes greater than 15,000 ft when breathing air, include a loss of critical judgment and willpower, with the subject usually unaware of any deterioration in performance or the presence of hypoxia. In this scenario, the pilot may have eventually lost the self-awareness required to identify the symptoms of hypoxia and take appropriate corrective action to resolve the situation. 

The oxygen system panel, which included the cylinder pressure gauge for the aircraft oxygen system, was recessed into the sidewall on the right side of the cockpit out of the pilot’s direct field of view. Consequently, it is also possible that the oxygen within the cylinder was eventually exhausted by the 3 occupants, without their awareness, resulting in a similar outcome. 

Organisational influences

Normalisation of deviance

Chief operating officer

The AGAIR chief operating officer (COO), who oversighted the line scanning operations, occasionally experienced VH-HPY’s intermittent pressurisation system defect while flying as pilot in command. On at least 2 occasions the COO continued to operate VH-HPY with a cabin altitude that required the use of oxygen, without access to a suitable oxygen supply.

On 16 October 2023, the pilot of the accident flight sent the COO an email stating that they were operating the aircraft with a high cabin altitude while using the aircraft’s oxygen system and, consequently, the oxygen cylinder needed to be refilled. The COO responded to the email by providing procedures to facilitate the refilling of the oxygen cylinder, but the hazardous practice of continuing to operate the aircraft with an excessive cabin altitude was not addressed. 

The COO was a senior AGAIR manager, and their actions (and inactions) had the potential to influence the operational standards of other pilots and crew, and set the risk appetite for the operation. Their practice of continuing to operate the aircraft and allowing it to be operated at FL280 with the pressurisation system defective exposed the aircraft’s occupants to significant risk of hypoxic induced incapacitation. In doing so, the COO likely normalised the deviation from the POH and civil aviation legislation and communicated the acceptance of such non-compliant practices by senior AGAIR management.

Head of flying operations 

The AGAIR head of flying operations (HOFO), who was also the owner, chief executive officer (CEO), and head of airworthiness and aircraft maintenance control (HAAMC), stated to the ATSB that they were aware of the intermittent pressurisation defect, but they were not aware of any pilots who had continued to operate the aircraft at FL280 with the pressurisation system defective. This was despite the HOFO having received and responded to an email from the pilot of the accident flight on 22 October 2023 that outlined the practice of operating the aircraft with a cabin altitude of 19,000 ft while using the aircraft oxygen system. The response from the HOFO to the email included the statement ‘thanks for keeping it going’. Such a response would have been reasonably perceived by the pilot of the accident flight as encouraging their practice of continuing to operate the aircraft at an excessive cabin altitude, and inappropriate use of the oxygen system.

The HOFO stated that they interpreted the email as being what ‘would’ happen rather than what ‘was’ happening. However, if the HOFO’s premise that they interpreted the email content as hypothetical is to be accepted, then it would be reasonable to expect that the HOFO would have immediately advised the pilot of the accident flight not to apply such a hazardous operational practice. However, the HOFO’s email response contained no such advice, and they did not contact the pilot by any other means to discuss the content of the email. 

The HOFO stated that they had not provided any operational advice to the pilot following the email as they had passed operational control of the line scanning activity to the COO. This included reporting lines for the pilot of the accident flight. The COO also received the same email from the pilot of the accident flight on 22 October 2023, but they did not reply or contact the pilot to discuss its content.

Operational control

The COO had oversight of the line scanning operation. However, the approved organisational structure, as contained within the AGAIR operations manual (OM), did not reflect this arrangement. Instead, the COO role was depicted as having responsibility for ground support equipment and personnel, customers and suppliers only. There were no defined responsibilities for the COO contained within the AGAIR OM, nor any procedures specific to line scanning operations, making it unclear exactly what the COO’s role entailed. 

The AGAIR OM permitted the HOFO to delegate ‘certain duties’ to company personnel, but the responsibility remained the HOFO’s. Consequently, the undocumented delegation of duties associated with the line scanning activities to the COO did not absolve the responsibility of the HOFO to ensure these activities were:

• compliant with aviation legislation
• conducted by pilots who conformed to company standards
• undertaken in an aircraft that was appropriate for the planned task.

The HOFO had long-term awareness of the pressurisation defect and had experienced the issue themselves while flying the aircraft. However, at no time had the HOFO (or the COO):

• recorded the pressurisation defect on the aircraft maintenance release or required other pilots to do so
• provided explicit procedures to pilots for managing the defect
• communicated the ongoing issue to the AGAIR safety manager
• submitted a hazard or occurrence report
• conducted or requested a formal risk assessment of the issue.

In the days leading up to the accident, both the HOFO and the COO were advised that the pilot of the accident flight was operating VH-HPY at a hazardous cabin altitude without access to a suitable oxygen supply. However, neither the HOFO nor the COO exercised effective operational control to address the significant safety implications of the activity. Instead, the HOFO and the COO’s combination of inaction, direct involvement and, in some instances facilitation and encouragement of the activities, resulted in a hazardous, ongoing practice.

Aircraft defects not recorded

The AGAIR operations manual contained policy and procedures to formally manage defects that were identified while an aircraft was in service. These procedures required the defect to be recorded on the aircraft’s maintenance release, and then communicated to the HAAMC, who would in turn liaise with the maintenance provider. Collectively, defects could then be appropriately managed, drawing upon approved data such as the POH, the aircraft maintenance manual and the relevant legislative requirements.

Records of defects and the actions taken to rectify them can provide a means to measure their effectiveness, and to help focus any further action if required. Similarly, the recording of defects on the maintenance release can provide a means for flight crews to readily assess any defects the aircraft may have had, and what rectifications were made. Flight crews could then anticipate further issues, brief other crew members, flight plan accordingly if needed, and proactively prepare for the defect should it re-occur.

Likely as a routine practice, evidenced from the records for VH‑LVG (a Gulfstream 690), and VH‑HPY (a Gulfstream 695A) and from interviews conducted during the investigation, AGAIR was managing defects in a simplified, but unapproved manner. This practice was similar to the approved method in that defects were sometimes communicated to the HAAMC or the maintenance provider by means such as email or text messages. However, defects were not always recorded on the maintenance release, and communication of defects sometimes occurred just prior to the aircraft arriving at the maintenance facility. This practice was likely to have been occurring for some time. As discussed below in CASA surveillance events, an AGAIR pilot reported concerns in 2019 that included the management of aircraft defects. 

Although similar, this routine practice removed risk controls that were in place to ensure that defects were managed for the safe operation of the aircraft. The issues affecting the pressurisation system of VH‑HPY did not mean that the aircraft could not be flown. The controls in place for safe operation in this case would require the aircraft be flown unpressurised, and at a suitable altitude. To operate the aircraft with an unserviceable or underperforming pressurisation system would have required an appropriate level of scrutiny by the pilot in command, the HOFO/HAAMC, the maintenance provider and, if needed, CASA.

The logbooks for the aircraft prior to 2014 when it was operating in South Africa showed that the pressurisation system was underperforming on multiple occasions, and detailed the actions taken to rectify the issue. Since 2014, and with the exception of an entry for a depressurisation event in August 2020, no instances of pressurisation defects occurring with VH-HPY had been recorded on the aircraft’s maintenance release. These defects were known to those operating and maintaining the aircraft, and any transfer of information relating to those defects was by informal means, such as orally, or electronically (email, text messages). Should an independent review of the aircraft’s history be required, it would be limited by the absence of defect endorsements relating to the aircraft’s pressurisation system from 2014 onwards.

When the pressurisation system in VH‑HPY was underperforming, the aircraft was sometimes operated with cabin altitudes above 10,000 ft by using the oxygen system for general operations rather than its intended function (that is, for use in an emergency situation). As previously discussed, this was known to the pilot of the accident flight, the HOFO/HAAMC, the COO, and on one occasion, the maintenance provider. While the Gulfstream 695A POH refers to the oxygen system as ‘supplemental’, it is unambiguous in that the oxygen system is for use in an emergency, providing sufficient oxygen to descend to an altitude where oxygen is no longer required.

Aircraft defects are sometimes minor, with limited or no operational impact. However, the operational impact of defects relating to VH-HPY’s pressurisation system was unnecessarily more significant because the defects were accepted by the pilot of the accident flight, the HOFO/HAAMC, and the COO, and then managed using the aircraft’s oxygen system, rather than rectified or, in the interim, conducting flights safely at lower altitudes. A full understanding of the operational impact of the defects was in part limited by their absence from the aircraft’s maintenance release. In turn, such records would have assisted in analysing the nature and frequency of the defects, and for corrective actions to be carried out by the appropriate persons, and in accordance with published data.

Air traffic control

Pressurisation information not communicated to air traffic control

While VH-HPY was still in flight, the Airservices Australia air traffic management director (ATMD) and shift manager (SM) spoke with the AGAIR HOFO by telephone to advise that ATC had lost radio communications with VH-HPY for an extended period. 

During the telephone conversation, which lasted nearly 6 minutes, the HOFO was advised that the pilot had exhibited symptoms of hypoxia, and that ATC had initiated ‘oxygen’ radio calls. The HOFO was also informed that ATC had subsequently regained direct communication with the pilot, who had confirmed operations were normal, and that ATC no longer had concerns for the aircraft and that the emergency phases had been cancelled. 

At no point during the telephone conversation did the HOFO advise the ATMD or SM that the aircraft had a known intermittent pressurisation defect as it did not occur to them to do so. It is possible the HOFO did not perceive a need to provide this information once they were advised that communications had been re-established with the pilot.

The telephone conversation to AGAIR was a missed opportunity to communicate critical safety information about the aircraft, that was directly relevant to the conversation, at a time when ATC could have taken further action to instruct the pilot to descend to a safe altitude. 

Air traffic controller actions

During the initial loss of communication while the aircraft was at FL280, the ATMD was able to speak briefly with the pilot via mobile telephone. The ATMD identified that the pilot’s speech during the conversation was slow and flat. This information was passed to the SM and Simpson region controller (controller), who also noted that the aircraft was slightly off track. As a result, the SM determined that the pilot may have been suffering from hypoxia and they initiated the hypoxic pilot emergency procedures and escalated the aircraft’s status to an alert phase.

That hypoxia assessment was likely correct given the analysis of the pilot’s speech indicated a progressive deterioration that was consistent with altitude hypoxia. Consequently, the initiation of the hypoxic pilot emergency procedures was the appropriate response.

Over the following 10 minutes, the controller attempted to get the pilot to descend the aircraft, as instructed by the hypoxic pilot emergency procedure, using the phrase ‘oxygen, oxygen, oxygen descend to one zero thousand feet’. They also made multiple attempts to contact the pilot on different frequencies and relayed messages via other aircraft within the vicinity of VH-HPY. At the same time, the ATMD attempted to call the pilot’s mobile phone again, and sent 2 text messages, but the pilot did not respond. Eventually, a crewmember on board a Royal Australian Air Force (RAAF) aircraft established contact with the pilot, followed by ATC a short time later. 

While ATC held significant concern for the aircraft and its occupants during the loss of communication period, their concerns were de-escalated over a period of 2 minutes after the pilot contacted the RAAF crew resulting in ATC downgrading and cancelling the emergency phases. This de-escalation occurred without querying why the pilot had not responded to ATC broadcasts for 1 hour and 13 minutes. 

The hypoxic pilot emergency procedures contained an instruction for the controller to advise the pilot to ‘check oxygen system and connections’ and ‘check pressurisation’. About 2 minutes after the cancellation of the uncertainty phase, the controller asked the pilot to ‘just confirm your oxygen system is ops normal’, to which the pilot responded ‘affirm’. No further actions from the hypoxic pilot emergency procedures were undertaken while the pilot was in communication with ATC. The controller recalled the pilot’s speech was ‘clear and concise’, but this was not consistent with the speech analysis that indicated a deterioration in the pilot’s speech at that time.

The pilot was subsequently provided with an ATC clearance to undertake the line scanning operations near Mount Gordon, but over the following 4 minutes the pilot repeated the clearance from the controller 4 times, seeming uncertain about the status of the clearance. They twice requested confirmation that the controller had copied their clearance readback. The radio recordings during this period indicate that the pilot’s speech rate had substantially lowered from earlier communications and was becoming worse. The controller recalled a lot of activity taking place in the vicinity of their console at that time, which included questions regarding the status of the aircraft. 

The pilot’s final radio transmission displayed the slowest speaking rate of all their communications during the flight and contained stuttering and operational mistakes. However, the controller did not re-identify the possibility of hypoxia. At the time of the accident, the Simpson region was ‘fully combined’ with one controller responsible for the entire region of about 2 million square kilometres. While the traffic density was described as low, the controller and the SM had been heavily tasked with attempts to regain communications with VH-HPY for an extensive period while also communicating with other aircraft within the region. 

Although no reason for the loss of communication had been established, the pilot had confirmed that the aircraft’s oxygen system was operating normally, and routine radio communications had been re-established. These factors, combined with ATC having no knowledge of the aircraft’s pressurisation system defect as the AGAIR HOFO had not communicated this information during their telephone conversation, likely resulted in the ATC personnel involved reducing their vigilance about hypoxia. Consequently, the controller did not identify the deterioration in the pilot’s speech and, in a return to normal operations, did not attempt to contact the pilot until about 18 minutes later. The pilot did not respond to any further calls from ATC and the aircraft impacted terrain a further 6 minutes later.   

Air traffic control hypoxia emergency procedures

At the time of the accident, the procedures to be used if a controller suspected a pilot may be suffering from hypoxia were contained in the Airservices Australia in-flight emergency response checklist (IFER) procedure (ATS-PROC-0062). The IFER hypoxia checklist contained a list of symptoms that could indicate a pilot was impacted by hypoxia, and the actions to take when managing the aircraft. This included advising the pilot:

• Check oxygen system and connections

• Check pressurisation

When confirmed and checked - if no change or condition worsens, act immediately to descend the aircraft.

The likely symptoms and signs of hypoxia, on acute exposure to altitudes greater than 15,000 ft when breathing air, include a loss of critical judgment and willpower. Because of the loss of self‑criticism, the subject is usually unaware of any deterioration in performance or the presence of hypoxia (Nicholson and Rainford 2000). Consequently, a reliance on a pilot’s response to queries regarding the status of the aircraft oxygen and pressurisation systems would probably yield an unreliable response if the pilot were impacted by hypoxia.

Additionally, the IFER hypoxia checklist contained no instructions for a controller to follow when standing down the emergency response and resuming normal operations. In contrast the Airservices Australia IFER management abnormal operations manual, which was used for training and information, did contain material, albeit limited, regarding the transition to normal operations after any type of inflight emergency. This included the statements:

• Extensive experience, both in Australia and overseas, shows that crews often try to down‑play problems when communicating with [air traffic control]. Furthermore, what may be normal as far as the crew is concerned may still preclude the operational system from operating normally

• If there is the slightest doubt about the continuing safety of the aircraft, it is prudent to continue with the IFER even if at a low key

The information contained within the IFER management abnormal operations manual was directly relevant to the hypoxic scenario involved during the accident flight, but the information was not integrated within the IFER hypoxia checklist, which is the document used by controllers during operations.

When designing emergency and abnormal checklists, human performance capabilities and limitations under high stress and workload should influence the design and content. Attention should be given to the structure of these checklists to ensure that directions and information are complete, clear, and concise (Burian et al 2005). As the advice regarding the transition to normal operations was contained in a different document which likely relied on a controller recalling it from memory, the IFER hypoxia checklist was not complete and did not provide adequate guidance to controllers for the process to follow when ceasing the emergency response. This omission increased the risk that the emergency response could be inappropriately downgraded during a developing hypoxic scenario.

CASA surveillance events

The available evidence indicated that CASA's oversight of AGAIR and GAM was broadly appropriate for the type and size of operations. There were 7 surveillance events from 2019 to 2023, including 4 site visits, and CASA issued various findings as a result.

In May 2019, CASA undertook a level 2 surveillance event of AGAIR to examine concerns reported by an AGAIR pilot, about non-compliant flight and duty rostering practices, and the management of aircraft defects involving 2 aircraft of a similar type to VH-HPY – VH-LVG and VH‑CLT. The latter concerns were about the deferral of defects that (according to the reported concerns) impacted the safety of operations ‘on a daily basis,’ and conflicting advice being given to pilots on the continuation of operations with such known defects. 

Had non-compliant maintenance practices been taking place at the time, and been discovered by CASA in its response to the reported concerns, this would potentially have been an opportunity to influence the way the operator managed aircraft defects, such as the pressurisation issue in VH‑HPY, in the intervening 4 years before the accident. Accordingly, the ATSB sought to determine the extent to which the concerns were valid, and the appropriateness and effectiveness of the CASA response at the time.

The approach used by CASA to conduct the surveillance was, according to the surveillance team’s airworthiness inspector (AWI), intended to determine whether there was any validity to the pilot’s concerns. The ATSB did not determine whether CASA contacted the complainant pilot prior to the surveillance commencing; this would be an important step to clarify the context and specifics of the raised concerns and help direct the surveillance activities. 

The on-site surveillance included:

• a physical inspection of 2 aircraft, including VH-LVG, which was one of the 2 aircraft that the correspondent had mentioned in their report as having maintenance problems
• review of the current VH-LVG maintenance release
• interviews with management personnel.

As a result of the surveillance activity, the pilot’s concern about flight and duty times was partially substantiated (the senior pilot was found to have exceeded flight and duty time requirements) and a safety finding to AGAIR was issued on this. 

On the maintenance aspects of the surveillance event, CASA made no findings, and the 2 maintenance-related observations did not directly indicate any problems with inappropriately deferred maintenance. In effect, based on the information sampled, CASA (at the time) found no evidence that defects with a significant effect on aircraft safety were not being managed appropriately or that pilots were being given conflicting advice on the continuation of operations. 

The ATSB assessment of maintenance records for VH‑LVG from December 2014–May 2019 showed 10 entries indicating unscheduled defect rectification that had been carried out during scheduled maintenance, and which had the characteristics of defects that could have appeared during operations and been identifiable by pilots (in which case they should have been recorded on the maintenance release). The absence of entries on recent historical (expired) maintenance releases up to May 2019 indicates that, during this period, some defects were likely not being recorded on the maintenance release when in service, and were only being rectified when the aircraft arrived for scheduled maintenance. However, only one of the defects was of a type that could have had an effect on the safety of flight (an engine oil pressure indicating system defect). In addition, defects may have been reported through a means other than through the maintenance release or detected during scheduled maintenance. 

The ATSB identified these entries by crosschecking the content of each maintenance release against the aircraft logbooks. The historical maintenance releases and aircraft logbooks were at a different facility to that visited by CASA for the May 2019 surveillance event, and this type of crosschecking activity was not scoped or undertaken as part of that event. 

Crosschecking maintenance releases, logbooks and maintenance worksheets can identify discrepancies or deficiencies in defect reporting, maintenance action tracking, or certification of work performed. This process also helps identify potential issues such as undocumented rectifications, improper deferral of defects, or systemic lapses in maintenance record-keeping, all of which can have implications for continued airworthiness and regulatory compliance. Any problems found can then lead to further evidence gathering regarding an organisation’s defect management practices (for example, directly from employed pilots).

The post-accident activities undertaken by CASA and the ATSB were influenced by facts and circumstances that were learnt after the accident involving VH-HPY. Consequently, the focus and depth of these activities could be directed towards areas of particular relevance to the accident, notably potential non-compliant defect management practices. The May 2019 surveillance did not have the same advantage. At the time this surveillance was conducted, AGAIR had no recent history of regulatory enforcement action or identified need for a higher level of surveillance, and there was limited detail within the pilot’s concern about specific defects or safety of flight issues. CASA also issued a safety finding and 3 observations as a result of the activity; although this enhanced the credibility of the AGAIR pilot’s reported concerns, it also indicates that the surveillance did improve safety within the chosen area of focus.

In summary, given the areas of concern raised by the complainant pilot, the scope of the surveillance event limited the extent of the evidence relating to defect management that was collected. This consequently limited the surveillance team’s ability to determine whether any non‑reporting and improper deferral of defects had been taking place at that time. While there was likely some degree of non-compliant defect management practices at AGAIR in 2019, all but one of the likely non-reported defects were minor in nature (the other was an oil pressure indicating system, which does not present an immediate risk to flight). Accordingly, even if CASA had identified these likely non-reported defects, it is unclear whether there would have been sufficient evidence available for CASA to identify maintenance practices as a broad organisational concern. 

Findings

From the evidence available, the following findings are made with respect to the pilot incapacitation, loss of control and collision with terrain involving Gulfstream 695A, VH-HPY, 55 km south-east of Cloncurry Airport, Queensland on 4 November 2023.

Contributing factors

• The pilot's ability to safely operate the aircraft was almost certainly significantly degraded by the onset of altitude hypoxia.
• While in cruise at flight level 280, both power levers were probably reduced without an appropriate descent rate being initiated, resulting in a progressive reduction of airspeed.
• The aircraft entered a descending anticlockwise turn with an increasing rate of descent. At about 10,500 ft, control input(s) were almost certainly made, probably an attempt to recover, that transitioned the aircraft from a high-speed descent to a spin condition that was likely unrecoverable and which continued until the impact with terrain.
• The pilot had a normalised practice of operating VH-HPY with a cabin altitude that required the use of supplemental oxygen. These flights were conducted without access to a suitable oxygen supply, significantly increasing the risk of altitude hypoxia induced incapacitation.
• The aircraft's pressurisation system probably did not attain the required cabin altitude when operating at flight level 280 during the accident flight. The pilot probably knowingly continued the flight with a cabin altitude that required the use of supplemental oxygen, without access to a suitable oxygen supply.
• The AGAIR aircraft VH-HPY pressurisation system could not reliably attain the required cabin altitude during flight due to a known, long-term, unresolved intermittent defect. AGAIR management personnel were aware of the defect and, through a combination of inaction, encouragement and, in some instances direct involvement, permitted the aircraft to continue operations at an excessive cabin altitude. (Safety issue)
• AGAIR management exercised ineffective operational control over the line scanning activities. As a result, the ongoing intermittent pressurisation defect was not formally recorded, the issues with the aircraft were not communicated to the AGAIR safety manager, and the hazardous practice of operating the aircraft at a cabin altitude that required the use of supplemental oxygen, without access to a suitable oxygen supply, was allowed to continue. (Safety issue)
• The AGAIR head of flying operations did not communicate critical safety information about the known intermittent pressurisation defect on VH-HPY when they were phoned by air traffic control about concerns that the pilot may be impacted by hypoxia.
• After being told by the pilot that operations were normal, controllers likely reduced their vigilance about hypoxia and did not re-identify the possibility of hypoxia during the subsequent progressive deterioration of the pilot’s speech.

Other factors that increased risk

• AGAIR Gulfstream 690 and 695 aircraft were operated with known defects without being recorded on the aircraft’s maintenance releases, likely as a routine practice. For VH‑HPY, the absence of documented historical information limited the ability to assess the operational impact of the pressurisation defect and the effectiveness of maintenance rectification activities. (Safety issue)
• The Airservices Australia hypoxic pilot emergency checklist did not contain guidance on ceasing the emergency response. This increased the risk that a controller may inappropriately downgrade the emergency response during a developing hypoxic scenario. (Safety issue)

Other finding

• A 2019 Civil Aviation Safety Authority surveillance event of AGAIR triggered by concerns reported by an AGAIR pilot, including delayed rectification of airworthiness issues, did not include a crosscheck of maintenance releases against the aircraft logbooks, which limited the surveillance team’s ability to determine whether any non-reporting and improper deferral of defects had been taking place at that time.

Safety issues and actions

Normalisation of deviance

Safety issue number: AO-2023-053-SI-03

Safety issue description: The AGAIR aircraft VH-HPY pressurisation system could not reliably attain the required cabin altitude during flight due to a known, long-term, unresolved intermittent defect. AGAIR management personnel were aware of the defect and, through a combination of inaction, encouragement and, in some instances direct involvement, permitted the aircraft to continue operations at an excessive cabin altitude.

Operational control

Safety issue number: AO-2023-053-SI-04

Safety issue description: AGAIR management exercised ineffective operational control over the line scanning activities. As a result, the ongoing intermittent pressurisation defect was not formally recorded, the issues with the aircraft were not communicated to the AGAIR safety manager, and the hazardous practice of operating the aircraft at a cabin altitude that required the use of supplemental oxygen, without access to a suitable oxygen supply, was allowed to continue.

Safety recommendation description: The ATSB recommends AGAIR initiates an independent review of their organisational structure and oversight of operational activities to assure ongoing effective operational control by management.

Aircraft defects not recorded

Safety issue number: AO-2023-053-SI-02

Safety issue description: AGAIR Gulfstream 690 and 695 aircraft were operated with known defects without being recorded on the aircrafts’ maintenance release, likely as a routine practice. For VH-HPY, the absence of documented historical information limited the ability to assess the operational impact of the pressurisation defect and the effectiveness of maintenance rectification activities. 

Air traffic control hypoxia emergency procedures 

Safety issue number: AO-2023-053-SI-01

Safety issue description: The Airservices Australia hypoxic pilot emergency checklist did not contain guidance on ceasing the emergency response. This increased the risk that a controller may inappropriately downgrade the emergency response during a developing hypoxic scenario. 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the next-of-kin of the pilot and both camera operators
• the pilot’s general practitioner
• AGAIR
• Airservices Australia
• Bureau of Meteorology
• Civil Aviation Safety Authority
• witnesses
• pilots who had previously operated VH-HPY
• General Aviation Maintenance
• a Gulfstream 695A training provider
• Jetfix aircraft maintenance personnel
• oxygen system provider
• Ontic
• OzRunways
• TrackPlus
• the previous owner of the aircraft
• Hartzell Propellers Inc
• Queensland Fire and Emergency Services
• Queensland Police Service
• a speech analysis specialist
• National Transportation Safety Board
• Defence Flight Safety Bureau 

References

Gradwell, D. & Rainford, D. (2016). Ernsting’s aviation and space medicine (5^th ed). Boca Raton, FL, US: Taylor & Francis Group

Sedlar, N. Irwin, A. Martin, D. & Roberts, R. (2022). A qualitative systematic review on the application of the normalization of deviance phenomenon within high-risk industries. School of Psychology, William Guild Building, University of Aberdeen, Aberdeen, UK. & Aberdeen Business School, Robert Gordon University (RGU), Aberdeen, UK.

US Federal Aviation Administration. (2015). Aircraft operations at altitudes above 25,000 feet mean sea level or mach numbers greater than .75. Advisory Circular 61-107B

US Federal Aviation Administration. (2021). Airplane Flying Handbook FAA-H-8083-3C. Chapter 5: Maintaining Aircraft Control: Upset Prevention and Recovery Training. Retrieved 14, January 2025 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the next-of-kin of the pilot and both camera operators
• AGAIR
• General Aviation Maintenance
• Civil Aviation Safety Authority
• Queensland Fire and Emergency Services
• oxygen system provider
• previous pilots who had flown VH-HPY
• National Transportation Safety Board
• a speech specialist
• Airservices Australia
• Airservices Australia air traffic management director
• Airservices Australia shift manager
• Airservices Australia controller
• Hartzell Propellers Pty Ltd
• Ontic
• a 695A training provider
• Defence Flight Safety Bureau. 

Submissions were received from:

• the next-of-kin of the pilot
• Airservices Australia
• Airservices Australia air traffic management director
• Airservices Australia shift manager
• AGAIR
• Civil Aviation Safety Authority
• oxygen system provider
• a 695A training provider

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Gulfstream 695A systems information

Pressurisation system

Gulfstream 695A pressurisation system

The Gulfstream 695A is pressurised by ducting air from both engines (known as bleed air) into the cabin and controlling its flow overboard via outflow safety valves to maintain the desired cabin pressure. The source of bleed air can be selected within the cockpit to be via both engines, via the left or right engine, or selected off. The selector directs power to close the relevant engine bleed air valve or valves, which are opened pneumatically when the engines are operating (Figure A1 and Figure A2).

Figure A1: VH-HPY cockpit layout 

Note: Image captured prior to the accident. Source: Cameron Marchant, annotated by the ATSB

Figure A2: Bleed air selector in VH-HPY

Note: Image captured prior to accident. Source: Cameron Marchant, annotated by the ATSB

A cabin pressure controller is set by flight crew to maintain cabin pressure from take-off, through climb, cruise, and descent. A rate of change knob in its ‘nominal’ position controls the cabin altitude rate of change (or vertical speed) to 500 ft/min and can be set from a minimum of 50 ft/min to a maximum of 3,000 ft/min. The cabin altitude knob is used to set the desired cabin altitude (up to 10,000 ft) and has an inner scale that shows the corresponding aircraft altitude that can be flown without exceeding the aircraft’s maximum differential pressure. The adjacent indicators for the cabin show the cabin altitude, differential pressure, and the cabin’s vertical speed (Figure A3).

Figure A3: Pressurisation controls and indicators fitted to VH-HPY

Note: Image captured prior to the accident. Source: Cameron Marchant, annotated by the ATSB

The cabin pressure controller also prevents the cabin differential pressure from exceeding the maximum differential pressure of 6.8 psi. The Gulfstream 695A is certified to operate up to 35,000 ft above mean sea level. At this altitude, and at the maximum differential pressure, the cabin altitude would be 9,600 ft.

The maximum differential pressure is prevented from being exceeded by the outflow safety valves, though if the aircraft continued to climb there would be a corresponding climb in the cabin altitude.

Visual warning system

The cabin altitude visual warning system is limited[45] to a single caption on the glareshield annunciator panel. The caption, ‘CABIN ALT’ is coloured red when illuminated, meaning that immediate corrective action is required (Figure A4).  When the cabin altitude of the aircraft is at or above 11,000 ft (± 500 ft), ‘CABIN ALT’ flashes for 10–20 seconds and is accompanied by an aural warning. After 10–20 seconds the annunciator remains on until the cabin altitude is below 11,000 ft.

Figure A4: Cockpit of VH-HPY showing annunciator panel cabin altitude warning light

Note: Image captured prior to the accident. Source: Cameron Marchant and Ontic (inset), annotated by the ATSB

Aural warning system

The cabin altitude aural warning system produces a tone that pulses 6 times per second. The aural warning is triggered when the cabin altitude exceeds 11,000 ft. The aural warning can be silenced by pressing a button on the left engine power lever (Figure A5).

Figure A5: Cabin altitude aural warning silencing button

Source: Ontic, annotated by the ATSB

Oxygen system

Overview

The Gulfstream 695A is equipped with an oxygen system that provides life support in the event of an emergency. The POH states that:

The airplane is equipped with a high pressure, gaseous oxygen system which provides supplemental breathing oxygen to the crew and passengers in the event of cabin depressurization during high altitude operation, or in the event cabin air becomes contaminated. The system will provide oxygen for sufficient time to permit a planned descent to an altitude where supplemental oxygen is no longer required.

Aviator’s dry breathing oxygen[46] is stored in a cylinder located in the rear fuselage and, when full, can supply oxygen to 3 people for about 29 minutes. The passenger oxygen system switch (Figure A6) is recessed into the sidewall on the right side of the cockpit, alongside a cylinder pressure gauge for the aircraft oxygen system.

Figure A6: VH-HPY cockpit oxygen gauge and passenger oxygen switch

Note: Image captured prior to accident. Source: Cameron Marchant annotated by the ATSB

Crew oxygen masks

The pilot and copilot oxygen masks are designed for rapid donning and are positioned on hooks immediately behind the pilot and co-pilot seats for ease of access. The masks incorporate a diluter control, a purge control, a flow indicator, and a microphone for radio communications (Figure A7).

Figure A7: Crew and passenger oxygen masks

Source: Ontic, annotated by the ATSB

When required in an emergency, and if the aircraft is operating below 20,000 ft, the oxygen mask diluter control is selected by the pilot to the normal position. Oxygen flows to the mask on demand (when the wearer inhales) and is mixed with cabin air. The flow of oxygen stops when the wearer exhales. The dilution of oxygen with cabin air helps to conserve stored oxygen.

When required in an emergency, and if the aircraft is operating above 20,000 ft, the oxygen mask diluter control is selected by the pilot to the 100% position. Oxygen flows to the mask on demand (when the wearer inhales) at a 100% concentration. The flow of oxygen stops when the wearer exhales.

The oxygen inlet line to the mask has a flow indicator, which is green when oxygen is flowing and red when there is no flow. The oxygen inlet lines are attached to the aircraft oxygen system via a coupling. When the aircraft is not flying, the mask oxygen inlet line couplings are disconnected to prevent possible leakage, and the passenger oxygen system switched off at the passenger oxygen system control panel.

Passenger oxygen masks

Passenger oxygen masks are stowed in containers at various locations in the cabin lining above the passenger seats. The mask assemblies consist of a mask cup, a bag that incorporates a flow indicator, and a lanyard which is attached to a pin.

The passenger oxygen switch has 3 positions – OFF, AUTO, and ON. When the switch is selected to AUTO, and when the cabin altitude reaches 11,000 (±500) ft, the passenger oxygen masks will drop from their containers and the oxygen lines to them will become pressurised. When selected ON, and regardless of cabin altitude, the passenger oxygen masks will drop from their containers and the oxygen lines to them will be pressurised. 

After dropping from their containers, the passenger masks are suspended by their lanyard. When a passenger dons their mask, this action pulls on the lanyard, and thereby the pin, which initiates a constant flow of oxygen to the mask. The flow of oxygen shuts off automatically when the cabin altitude decreases to 8,000–10,000 ft. Selecting the passenger oxygen switch to OFF also shuts off the flow of oxygen.

Oxygen system servicing and duration

When required, aircraft oxygen cylinders are serviced (refilled) with aviator’s dry breathing oxygen by trained personnel using specialist equipment. The aircraft cylinder is full when filled to 1,800 psi. 

The Gulfstream 695A POH provides a table to calculate the duration of on-board oxygen, should it be required in an emergency (Figure A8). Duration is calculated by determining the oxygen cylinder pressure and the number of people on board the aircraft. The duration of on-board oxygen with 3 people on board and with a full oxygen cylinder should be just over 29 minutes.

Figure A8: Oxygen system duration table

Source: Ontic, annotated by the ATSB

Autopilot

The autopilot fitted to VH-HPY was a Collins AP-106 and it was integrated with the aircraft’s instruments. The Collins AP-106 is a 3-axis system that stabilises the aircraft about its roll, pitch, and yaw axes. The autopilot roll servo acts on the aircraft’s ailerons, a pitch servo acts on the aircraft’s elevators, and an additional pitch servo provides a trim function. A servo acts on the rudder for yaw dampening[47] which can be operated independently of the autopilot.

The autopilot operates in its ‘attitude’ function when engaged and no mode is selected. This function incorporates a pitch hold mode. The autopilot operates in its ‘guidance’ function when engaged and a mode is selected on the mode control panel, which is located on the centre pedestal below the pressurisation controls. Heading (HDG), navigation (NAV), approach (APP), and back-course (B/C) are lateral modes that receive commands from the aircraft’s instruments. Altitude (ALT) and indicated airspeed (IAS) are vertical modes and are used to hold a selected altitude or airspeed. A pitch hold mode is operational when no vertical modes are selected. The autopilot can be biased manually via a control adjacent to the mode control panel. 

Both pilot and co-pilot control wheels have thumb-operated buttons that interrupt the autopilot when pressed to allow the aircraft to be hand flown. Both control wheels have autopilot release switches, and the pilot control wheel has a thumb-operated pitch trim switch.

A subcomponent of the autopilot system, the trim servo monitor, has fault detection and diagnostic capabilities that automatically disengage the autopilot if a discrepancy or malfunction is detected. One such potential fault condition is the exceedance of threshold voltages within a servo as it works against an aerodynamic or mechanical force. 

Appendix B – Transcript – Telephone call between Airservices Australia personnel and the AGAIR head of flying operations

Source: Airservices Australia

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.