Previous recommendation

On 23 October 2002 the ATSB issued the following recommendation as a result of a fatal accident at night near Newman, WA, (ATSB Investigation BO/200100348):

Recommendation R20020193
The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority (CASA) review the general operational requirements, training requirements, flight planning requirements and guidance material provided to pilots conducting VFR operations in dark night conditions.

On 13 December 2002, CASA responded to the recommendation as follows:

CASA acknowledges the intent of this Recommendation. As part of the proposed CASR [Civil Aviation Safety Regulations] Part 61, CASA is developing the requirements for night VFR ratings which will be based on the existing Civil Aviation Order CAO 40.2.2. In addition, a draft competency standard for night visual flight operations has been developed for inclusion in the proposed CASR Part 61 Manual of Standards. CASA plans to publish a Notice of Proposed Rule Making [NPRM] in relation to this matter in March 2003.

During July 2003, CASA published NPRM 0309FS Flight Crew Licensing and Draft Part 61 Manual of Standards [MOS]. The draft MOS included a requirement for a periodic flight review of night flying competencies. On 24 November 2004, the Chief Executive Officer of CASA issued two directives related to the regulatory reform process. As of March 2005, CASA was working on the processes necessary to apply the directives to the development of new CASR parts, including Part 61. In a letter to the ATSB dated 6 January 2006, CASA advised that the proposed CASR Part 61 would require night VFR rating holders to undergo flight reviews covering night and instrument flying, in addition to structural changes to the night VFR rating. CASA advised that Part 61 could be completed in the second half of 2006.

During March 2005, the ATSB issued Aviation Safety Investigation report BO/200304282 on the fatal night accident involving a Bell 407 helicopter, registered VH-HTD, which occurred off Cape Hillsborough, Queensland, on 17 October 2003. The report stated that CASA had advised that they intended to issue a CAAP (Civil Aviation Advisory Publication) to clarify safety guidelines for night VFR operations. In a letter to the ATSB dated 6 January 2006, CASA advised that the Night VFR CAAP was in the final stages of preparation, and it was intended that it would be published in the first quarter of 2006. The CAAP would include competency standards for night and instrument flying.

CASA has also advised that copies of a night VFR-related 'Briefing in a Box' were distributed to flying schools in March 2006. The briefings included safety material on night flying and were intended to assist flying instructors and flying schools in providing appropriate training to night VFR pilots.

The investigation was unable to establish why the pilot lost control of the aircraft during a climbing turn while apparently returning to land at Caloundra aerodrome.

However, the following issues are considered to have been significant to the circumstances of the accident.

Aircraft altitude

The altitude of the aircraft as it passed over Bokarina was well below the minimum permissible for a night visual flight rules (VFR) flight, and was also below the minimum for a flight over a populated area. The aircraft's maximum altitude of 742 ft after it crossed the coast provided little margin for inadvertent height loss during the subsequent turn, and was evidently insufficient to allow the pilot to regain control of the aircraft.

Aircraft systems

There was no indication from the recorded radar information that the performance of the aircraft was abnormal. No radio transmission was heard from the pilot to indicate any problem with the aircraft.

Although one witness at Bokarina described the engine noise as abnormal, three other witnesses described the sound as normal and there was clear physical evidence that the engine was operating at high power at impact. There was also evidence that electrical power was being delivered to the lights, and that pneumatic power was being delivered to the gyroscopic instruments.

There was no evidence of a defect that could have affected the controllability of the aircraft. However, impact damage and the unavailability of some parts of the aircraft prevented a comprehensive assessment of the pre-impact serviceability of the flight control system.

Physiological and cognitive factors

The aircraft's recorded cruise altitude of 11,300 ft was above the altitude at which the Civil Aviation Safety Authority (CASA) required supplemental oxygen to be used, but was below the altitude above which oxygen should be used according to the aircraft flight manual.

By flying at 11,300 ft without supplemental oxygen, the pilot increased his risk of developing hypoxia. However, any hypoxic effect on the pilot's performance could not be quantified. The aircraft's steady track and descent profile prior to passing overhead Caloundra suggest that the pilot, probably assisted by the autopilot, was effectively controlling the aircraft. Further, any adverse physiological effects of mild hypoxia would have reduced before the final stages of the flight. However, it is possible that the pilot's cognitive function during the latter part of the flight was affected by earlier exposure to hypoxic conditions.

The duration of the day's flying, together with an inadequate food intake, could have caused the pilot to become fatigued.

Fatigue and hypoxia have been demonstrated to adversely affect areas of cognitive function such as response time, decision-making and risk assessment. Any decrement in cognitive function could have reduced the pilot's ability to identify the reduced level of safety associated with conducting a low-level flight at night over a populated area, and transitioning from an area of extensive ground lighting to an area where surface features and the natural horizon were difficult to discern. However, there was no means of determining if the pilot's cognitive function had been adversely affected. Nor was it possible to determine that if affected, it had not recovered to its normal state once the pilot was no longer exposed to hypoxic conditions.

The pilot's reported difficulties with balance following the April 2002 stapedectomy and subsequent removal of the prosthesis were consistent with expected side-effects of the operations. While these difficulties persisted for some months after the operation, the available evidence indicated that the pilot was not affected by dizziness or balance problems in the months preceding the accident.

Spatial disorientation

The forecast weather conditions did not preclude night VFR flight, and witness reports indicated that there was no reduction in visibility due to smoke or cloud at the time of the accident. The pilot's attention was probably directed outside the cockpit as he positioned the aircraft to fly over his home. Extensive ground lighting associated with the populated Sunshine Coast area would have provided him with good surface and horizon reference during that period. However, after the aircraft turned east, it was heading towards an area of no surface lighting (other than that provided by one or two large ships), and minimal celestial illumination. Consequently, surface features and the natural horizon would have been difficult to discern. Those conditions required that the pilot transition to flight by reference to the aircraft instruments.

The pilot's recorded night flight time indicated that he satisfied the recency requirements for night VFR. Further, the pilot was flying a familiar aircraft, which was suitably equipped (including a standby pneumatic power source) and maintained for instrument flight. However, the pilot had not demonstrated competence in flight solely by reference to instruments since 1998. The Federal Aviation Administration Advisory Circular 60-4A indicated that even qualified instrument pilots can take up to 35 seconds to complete the transition from visual to instrument flight. If the pilot did not achieve a rapid and complete transition to instrument flight during the climbing turn, it is likely that he would have experienced the effects of spatial disorientation.

Because there was no regulatory requirement that the pilot's recurrent aeroplane flight reviews include night VFR or instrument flight, his level of recent competence could not be assessed. The pilot's ability to transition to flight solely by reference to instruments may have been adversely affected by various factors, including a lack of recent experience in instrument flight, possible residual effects of hypoxia, fatigue, and/or a distraction in the cockpit. If the pilot's attention was directed elsewhere, he may not have initially recognised that the aircraft was descending, or the degree to which it was turning after it crossed the coast.

The ability to maintain visual reference with surface features and the natural horizon at night is not assured, even in meteorological conditions that satisfy the night VFR requirements. Consequently, as the Flight Safety Australia (May-June 2005) article advised, it is imperative that night VFR pilots are competent and current in instrument flight. Completing an aeroplane flight review and satisfying the night VFR requirements may not sufficiently reduce the risk of spatial disorientation of a pilot during night VFR operations.

Conclusions

The circumstances of the accident are consistent with a loss of control due to the pilot becoming spatially disoriented after flying into an area of minimal surface and celestial illumination. Physiological and cognitive factors may have contributed to the development of the accident. However, the factors that contributed to the aircraft descending into the water could not be conclusively established.

This accident highlights the need for night VFR pilots to manage the risk of spatial disorientation in dark night conditions by maintaining proficiency in instrument flight.

FACTUAL INFORMATION

History of the flight

At about 1730 Eastern Standard Time on 15 August 2004, the pilot of a Mooney Aircraft Corporation M20K aircraft, registered VH-DXZ, departed Cobar, NSW, on a private flight to Caloundra, Qld. The flight was conducted under the visual flight rules (VFR), with the latter part at night.

At about 2015, several people saw and heard the aircraft, with its wing tip strobe lights flashing, flying low in a northerly direction over Bokarina, 8 km north-north-east of Caloundra aerodrome. One witness said that the engine sounded as though it was 'struggling and cutting out'. Two other witnesses described the engine sound as a 'steady drone', while another said it sounded like it was 'turning at low [revolutions], as if it was powered down for a landing'.

The aircraft was then observed to turn east and cross the coast before descending steeply and impacting the water. The impact was accompanied by a bright flash. The aircraft wreckage was located 4 days later, approximately 1.5 km east of Bokarina beach, at a depth of about 16 m. The pilot, who owned the aircraft and was the sole occupant, did not survive the impact.

Earlier that afternoon, the pilot had flown from Caloundra to Cobar with one passenger. The passenger remained at Cobar and reported that the flight from Caloundra had been uneventful and that they arrived at Cobar at about 1700. The refueller advised that the pilot refuelled the aircraft with 156 L of avgas (apparently to full tanks) and checked the engine oil before departing on the return flight to Caloundra.

The pilot lived at Bokarina and family members reported that he did not normally fly over his home on returning from a flight. They indicated that the pilot's car was at the aerodrome, so he did not need to be met and driven home. They assumed that the purpose of flying over the house was to let them know that he would be home soon.

Recorded information

The pilot was not required to report to air traffic control during the flight and there was no record of him having done so. The Caloundra Common Traffic Advisory Frequency did not have a recording capability.

A pilot conducting a VFR flight was required to operate the aircraft's secondary surveillance radar (SSR) transponder on code 1200 in airspace not subject to air traffic control. The Mooney's SSR track for the flight was recorded by The

Australian Advanced Air Traffic System. That data showed that the aircraft first appeared on radar at 1903, north of Moree, NSW, on the direct track from Cobar to Caloundra at 11,300 ft. The aircraft maintained that altitude until 1937, when it commenced descent, passing through 10,000 ft at about 1940, and 5,000 ft at about 1958. It maintained a steady track and descent profile, and was overhead Caloundra at 2014, at 1,140 ft. The aircraft then maintained a relatively constant altitude and tracked north towards Bokarina (Figure 1).

At 2015, the aircraft commenced a further descent and when overhead Bokarina, turned right and headed east-north-east, towards the ocean. Radar data indicated that the aircraft descended to 442 ft about the time it flew over the beach. The aircraft's altitude then increased, reaching a maximum of 742 ft. The last valid radar information was recorded at 2016:13, and indicated that the aircraft had entered a descending right turn. The recorded radar data did not reveal any abrupt or abnormal changes in the aircraft's altitude, groundspeed, or track. The recorded speeds were consistent with normal cruise and descent speeds for the aircraft type (Appendix A).

Figure 1: The aircraft's radar-recorded track

Pilot information

The pilot purchased the aircraft in May 1994, and was issued with a private pilot (aeroplane) licence in July 1994. His logbook recorded his total flying experience at the time of the accident as about 1800 hours, 142 of which were at night. In April, May and June 2004, the pilot logged 5, 0.5 and 5.4 hours night flying respectively, all in DXZ. In those same months, he also logged 20.8, 12.3, and 25.4 hours day flying. The pilot last flew at night on 19 June 2004, and in actual or simulated instrument meteorological conditions, during 1998. His total instrument flight time was recorded as 32.4 hours.

The pilot was issued with a night VFR rating on 11 June 1998. There was no evidence that he had ever held an instrument rating. His three most recent flight reviews were completed on 29 March 2003, 18 November 2001, and 24 November 2000. They were logged as day flights, with no instrument or night flight recorded.

The pilot's family reported that he was well rested before the flight, was not affected by any illness and had never smoked cigarettes.

A person who spoke to the pilot while he was at Cobar reported that he said that it had been a busy day, and that he had not had any lunch, but was carrying some nuts and a drink on the aircraft.

Aircraft information

The aircraft was manufactured in the US in 1988 and was imported into Australia in the same year. At the time of the accident, it had accumulated about 2,868 flight hours. The aircraft was equipped and maintained in the instrument flight rules (IFR) category. It was fitted with a turbo-charged, piston engine which had accumulated about 180 hours since the last overhaul.

The aircraft cabin was not pressurised but was fitted with a supplemental oxygen system. The organisation that maintained the aircraft reported that the supplemental oxygen system tank was empty. There was no indication that the oxygen tank had been charged at Cobar.

A review of the aircraft's maintenance records revealed that the requirements of Airworthiness Directives (AD) RAD/43 and RAD/47¹ were due to be completed in July 2004 but had not been carried out. No other discrepancies were noted, and no defects had been recorded on the maintenance release.

The aircraft was fitted with an electrically driven standby vacuum system for providing pneumatic power to the gyroscopic instruments, and a Century 2000 autopilot system.

Meteorological information

Information provided by the Bureau of Meteorology indicated that the weather conditions in the Bokarina area at the time of the accident were benign. Smoke areas were forecast below 6,000 ft with visibility reducing to 4,000 m in smoke, and 1,000 m in thick smoke. The terminal area forecast for Maroochydore aerodrome (15 km north-north-west of Bokarina), issued at 1813, predicted visibility greater than 10 km and scattered cloud at 3,000 ft. None of the witnesses reported that smoke, cloud or haze affected their ability to see the aircraft.

The QNH² recorded by the automatic weather station at Maroochydore at 2020 on the day of the accident was 1014 hPa.

On 15 August 2004 at the accident location, astronomical twilight occurred at 1846 and the moon set at 1637³. Two cargo ships were located east of Maroochydore at the time of the occurrence, at least one of which was at anchor, and therefore displaying lights⁴. Several hours after the accident, witnesses observed two large ships moored east of Maroochydore which were displaying deck lights.

Wreckage and impact information

The wreckage was raised from the seabed on 28 August 2004 (Figure 2). Most of the aircraft was recovered, including the engine, fuselage, left wing, all three propeller blades and the propeller hub. The right horizontal stabiliser, right elevator, and parts of the right wing were not recovered.

An examination of the wreckage indicated that:

• The aircraft was banked right, and in a nose-down attitude of approximately 45 degrees when it struck the water.
• The nature of the damage to the engine crankshaft and the propeller blades was consistent with the engine delivering high power at impact.
• The frangible plastic drive shaft of the engine driven vacuum pump had failed under a sideways load. The drive shaft of the electrically driven vacuum pump was intact.
• Damage to the gyroscopes in the artificial horizon and directional indicator flight instruments was consistent with gyroscopic rotation at impact.
• The light globes in the artificial horizon and the directional indicator flight instruments were receiving electrical power at impact.
• The landing gear was retracted, and the wing flaps were extended about 10 degrees, at impact.
• The altimeter subscale was set at 1015.
• There was evidence of a short duration, post-impact fire.

Impact and saltwater corrosion damage precluded a determination of the serviceability of the automatic pilot system and its operational status during the final stages of the flight. None of the windscreen was recovered. There was no evidence in the recovered wreckage that the aircraft had struck a bird or a bat during flight.

The extent of airframe disruption and the missing parts of the right wing, horizontal stabiliser and right elevator prevented a comprehensive assessment of the functionality of the flight controls at impact.

Figure 2: Recovery of the main wreckage

Regulatory aspects

The pilot's night VFR rating authorised him to act as pilot in command of private or aerial work flights at night under the VFR. Civil Aviation Order (CAO) 40.2.2 detailed the flight tests and other requirements for the issue of a night VFR rating. The test requirements included recovery from unusual attitudes, basic turns, and straight and level flight, which were required to be conducted solely by reference to flight instruments. The CAO also required that training for the issue of a night VFR rating included at least one landing at an aerodrome 'that is not in an area that has sufficient ground lighting to create a discernible horizon'.

Once issued, a night VFR rating remained permanently valid. To exercise the privileges of the rating, a pilot needed to meet certain minimum recent experience requirements. There was no requirement for the holder of a night VFR rating to have any recent instrument flight time prior to conducting a flight at night ⁵.

Except during take-off, landing, or radar vectoring, the pilot of a night VFR flight was required to ensure than the aircraft remained at or above the calculated lowest safe altitude (LSALT) while further than 3 NM from the destination aerodrome. The minimum LSALT for the Bokarina area was 1,500 ft. Aircraft operating overpopulated areas were generally required to remain at or above 1,000 ft.

A pilot was required to satisfactorily complete an aeroplane flight review every 2 years. There were no published requirements or guidance material regarding theoretical knowledge or practical skills (such as flight conducted solely by reference to flight instruments) required to be demonstrated by pilots undergoing an aeroplane flight review.

Medical and pathological information

The pilot held a valid Class 2 Medical Certificate at the time of the occurrence. His medical records indicated that he had undergone a stapedectomy⁶ operation on his left ear about 22 years before the accident. He underwent a stapedectomy on his right ear on 11 April 2002 because of hearing loss. However, due to a post-operative decline in hearing and persistent balance problems, the prosthesis was removed on 24 April 2002. During two subsequent telephone conversations with the surgeon in June and July 2002, the pilot reported that he was still dizzy, couldn't look up and down quickly, and was still unsteady.

The pilot underwent a Class 2 aviation medical examination on 1 March 2004. The designated aviation medical examiner who performed that examination reported that the pilot had advised of no ongoing dizziness, disorientation, or other related problems.

A pathological examination did not identify any indication of a pre-existing medical condition that could have contributed to the development of the accident. It was not possible to establish when, or what, the pilot had last eaten.

Hypoxia

Hypoxia is a condition in which there is reduced oxygen supply to the body. Available oxygen decreases with increased altitude, such that at 12,000 ft, brain oxygen saturation is approximately 87%, compared with sea level saturation of 96%.
The investigation calculated that if the entire cruise segment of the flight had been conducted at 11,300 ft, the aircraft would have been at that level for almost 2 hours.

The US Federal Aviation Administration⁷ (FAA) recommended that pilots use supplemental oxygen when flying above 10,000 ft during the day and above 5,000 ft at night when the eyes become more sensitive to oxygen deprivation.

The Mooney M20K Aircraft Flight Manual stated that 'supplemental oxygen should be used when cruising above 12,500 feet. It is often advisable to use oxygen at altitude lower than 12,500 feet under conditions of night flying, fatigue, …'.
Civil Aviation Order (CAO) Part 20.4 paragraph 6.1 stated:

A flight crew member who is on flight deck duty in an unpressurised aircraft must be provided with, and continuously use, supplemental oxygen at all times during which the aircraft flies above 10,000 feet altitude.

An article⁸ in Flight Safety Australia magazine stated '[a]fter vision, the tissues most affected by hypoxia are those areas of the brain associated with judgement, self-criticism and the accurate performance of mental tasks'. An associated article⁹ in the same magazine indicated that the use of oxygen during night flight below 10,000 ft resulted in an increase in alertness and cognitive function, and a reduction in fatigue. Studies of the effects of exposure to altitudes between 10,000 ft and 15,000 ft have consistently shown small to moderate effects on human performance. Those effects included a reduction in night and peripheral vision, increased drowsiness, decreased response time, decreased short-term memory capacity, and poorer performance on complex and reasoning tasks.

The FAA Civil Aerospace Medical Institute Human Factors Research Laboratory in Oklahoma City, USA advised that restoration of a sea level atmosphere following exposure to hypoxic conditions caused rapid physiological recovery, but that cognitive recovery was slower.

Fatigue

Fatigue results from inadequate rest over a period of time, and leads to physical and mental impairment. The effects of fatigue include decreased short-term memory, slowed reaction time, decreased work efficiency, increased variability in work performance, a tendency to accept lower levels of performance and not correct errors. Not consuming food regularly is known to exacerbate the effects of fatigue.
Based on previous flights recorded in the pilot's logbook, the total flight time for the trip from Caloundra to Cobar and return to Caloundra would probably have been between 6.4 and 6.9 hours.

Stapedectomy

Stapedectomy involved a small risk of ongoing episodes of dizziness and hearing loss¹⁰. However, according to an article published in 1998 in the journal Otolaryngology - Head and Neck Surgery¹¹,

The FAA [Federal Aviation Administration] has always had the most experience with aircrew returning to flying duties after stapedectomy. The civilian track record is excellent with no reported cases of sudden incapacitating vertigo, sudden hearing loss, or other poststapedectomy related sequelae.

Spatial disorientation

Spatial disorientation describes an in-flight situation in which a pilot does not correctly sense the position, motion or attitude of the aircraft, and may be unable to tell which way is up. A pilot operating under the VFR determines the attitude of an aircraft by reference to the natural horizon or surface features. If these references are not visible, the pilot must use the flight instruments to determine the aircraft's attitude.

The risks of non-instrument rated pilots flying in conditions in which they are not able to orientate the aircraft by visual reference have been well known for over 50 years. During testing conducted on a group of non-instrument rated pilots, the average time before loss of control of the aircraft, after visual reference was lost, was 178 seconds¹². An article titled 'Fatal Night Flight' in the Civil Aviation Safety Authority (CASA) magazine Flight Safety Australia (May-June 2005) stated that:

[v]isual disorientation is a distinct possibility on dark nights or away from areas of extensive ground lighting. Disorientation can be caused by sudden loss of visual reference such as when turning away from a well lighted area towards an area without ground lighting.

The article also stated that 'it is imperative that Night VFR pilots are competent and current in instrument flight'.

US FAA Advisory Circular 60-4A, Pilot's Spatial Disorientation, was published in 1983 and was intended to inform pilots of the hazards associated with disorientation caused by loss of visual reference with the surface. It included the following information:

Tests conducted with qualified instrument pilots indicate that it can take as much as 35 seconds to establish full control by instruments after the loss of visual reference with the surface.

Surface references and the natural horizon may at times become obscured, although visibility may be above visual flight rule minimums. The lack of natural horizon or surface reference is common on over water flights, at night, and especially at night in extremely sparsely populated areas, or in low visibility conditions.

Recent night VFR accident

On the evening of 17 October 2003, an air ambulance Bell 407 helicopter descended into the sea near Mackay, Qld. The ATSB investigation (200304282) was unable to determine, with certainty, what factors led to loss of control of the helicopter. The investigation considered that although the forecast weather conditions did not necessarily preclude flight under the night VFR rules, the lack of a visible horizon and surface lighting, and the pilot's limited instrument flying experience may have contributed to the accident. The investigation concluded that the circumstances of the accident were consistent with loss of control due to the pilot becoming spatially disoriented.

1. AD/RAD/43 required a biennial altimeter and encoder check and AD/RAD/47 required a biennial transponder check.
2. Sea-level atmospheric pressure.
3. Information obtained from Geoscience Australia website http://www.ga.gov.au/nmd/geodesy/astro/
4. Vessels over 100 m long and at anchor are required to display white lights at either end of the vessel and available working lights or equivalent to illuminate the decks.
5. In contrast, the holder of an instrument rating was required to undergo an annual instrument flight test, and comply with flight and instrument approach recency requirements, in order to keep the instrument rating current.
6. Stapedectomy is an operation to remove the fixed stapes [the third middle ear bone] and to replace it with a prosthesis. That allows sound vibrations to be transmitted properly to the inner ear for improved hearing. http://www.bcm.edu/oto/clinic/educate/stapled.html
7. Federal Aviation Administration. 2003. Advisory Circular AC 61-107A Operations of Aircraft at Altitudes Above 25,000 feet MSL and/or Mach Numbers (MMO) Greater than .75.
8. Brock, J. & Bencke, R. 1998. Hypoxia. Flight Safety Australia. Volume 3 Number 1. Civil Aviation Safety Authority. Canberra.
9. Thom, A. 1998. Improved Performance. Flight Safety Australia. Volume 3 Number 1. Civil Aviation Safety Authority. Canberra.
10. http://www.bcm.edu/oto/clinic/educate/stapled.html
11. Thiringer, J.K. & Arriaga, M.A. 1998. Stapedectomy in Military Aircrew. Otolaryngology - Head and Neck Surgery. Volume 118 Number 1. January 1998.
12. Bryan, L.A., Stonecipher, J.W. & Aron, K. 1954. 180-degree turn experiment. University of Illinois Bulletin. 54(11), 1-52.

At about 2017 Eastern Standard Time on 15 August 2004, a Mooney Aircraft Corporation M20K aircraft, registered VH-DXZ, descended into the ocean off Bokarina, Queensland. The pilot, who owned the aircraft and was the sole occupant, did not survive the impact.

The pilot held a private pilot (aeroplane) licence and a night visual flight rules (VFR) rating. His logbook recorded his total flying experience at the time of the accident as about 1800 hours, 142 of which were at night.  The pilot last flew at night on 19 June 2004, and in actual or simulated instrument meteorological conditions, during 1998. His three most recent flight reviews were logged as day flights, with no instrument or night flight recorded.

The weather conditions in the area at the time of the occurrence were benign. Astronomical twilight occurred at 1846 and the moon set at 1637.

The wreckage was recovered 13 days after the accident. An examination revealed that at the time of impact; the engine was delivering high power, the instrument lights were receiving electrical power, and the gyroscopic instruments were receiving pneumatic power.

The circumstances of the accident are consistent with a loss of control due to the pilot becoming spatially disoriented after flying into an area of minimal surface and celestial illumination. Physiological and cognitive factors may have contributed to the development of the accident. However, the factors that contributed to the aircraft descending into the water could not be conclusively established.

This accident highlights the need for night VFR pilots to manage the risk of spatial disorientation in dark night conditions by maintaining proficiency in instrument flight.

ANALYSIS

The circumstances of the engine failure were such that there was no prior indication to enable the crew to take any action that may have minimised the extent of the engine damage.

The blade failed as a result of a low cycle fatigue cracking mechanism associated with cracking of the blade's vapour aluminised coating.

FACTUAL INFORMATION

At 1435 Eastern Standard Time on 10 August 2004, a Boeing Company 717-200 aircraft, registered VH-VQA, was climbing to cruise altitude on a scheduled passenger service from Melbourne, Vic. to Hobart, Tas. with six crew and 52 passengers on board. As the aircraft passed through flight level (FL) 110, the crew heard a loud bang, with a corresponding increase in indicated left engine vibrations. The left engine began to spool down and the turbine gas temperature (TGT) indications began to increase significantly.

The crew initially brought the left engine power lever back to idle. However, the TGT continued to increase, indicating a maximum of 1,149^oC, before they shut the engine down and discharged a fire bottle into the cowling area in accordance with the operator's procedures. They then notified Melbourne air traffic control (ATC) of the engine failure and returned to Melbourne.

The operator examined the left engine and found metal fragments in the exhaust area and some metallisation¹ of the exhaust duct.

At the time of the failure, the BR700-715 engine, serial number 13148, had completed 10, 321 hours and 8,888 cycles since new, and 6,474 hours and 5,417 cycles since repair.

Engine investigation

The operator removed the engine and forwarded it to the engine manufacturer in Germany for detailed investigation, under the supervision of a representative of the German Federal Bureau of Aircraft Accident Investigation (BFU²), on behalf of the Australian Transport Safety Bureau (ATSB).

The manufacturer conducted a visual inspection of the engine's exterior, noting a bulge around most of the circumference of the high-pressure turbine (HPT) casing (Figure 1), in line with the Stage-1 HPT (HPT 1). A borescope examination of the engine interior showed that one HPT 1 blade was almost completely missing, with the remaining HPT 1 blades separated just above the blade platforms (Figure 2). There was also significant damage to the subsequent HPT and low-pressure turbine stages. Examination of the engine's compressor assembly revealed no significant damage. All of the high energy debris from the failure had been fully contained³.

A detailed examination of the engine revealed that the reason for the engine failure was the release of a single HPT 1 blade. The blade failed following the development of low-cycle fatigue⁴ (LCF) cracking in its internal cooling passages. All other engine damage was considered to be a consequence of the initial HPT 1 blade failure.

Figure 1: Bulged HPT casing

Figure 2: Damage to HPT 1 and HPT 2 rotors

Blade design considerations

The failed HPT 1 blade (Figure 3) was a life improvement package⁵ (LIP) blade. The blade was a shrouded-tip aerofoil design, with multi-passage internal cooling (Figure 4). There was a vapour aluminised coating on the blade's external aerodynamic surfaces and internal cooling passages.

The manufacturer indicated that there have been four similar failures of LIP HPT blades in the BR700-715 engine type, with another engine failure still under investigation. One failure occurred prior to this event in November 2003. The remainder occurred after this incident.

Figure 3: The failed HPT 1 blade (position 21)

Following those failures, the manufacturer conducted additional computer stress modelling on the LIP blades. That modelling found that there were stress levels in the larger trombone radius feature, within the blade's cooling passages (Figure 4) that were potentially in excess of the manufacturer's original design intent. The manufacturer also found that the thickness of the vapour aluminised coating inside the blade's internal cooling passages was variable and difficult to predict. In certain operational conditions, dependent upon high strains in areas of stress concentration and local temperature, the coating could crack with the possibility of subsequent growth into the coated (parent) material. The area from which the failure occurred was confirmed to be the most susceptible to this behaviour (Figure 5).

Figure 4: Intact HPT 1 blade (left); blade internal cooling passage showing trombone feature (right)

Figure 5: Computer generated stress diagram from the manufacturer indicating the point of potentially excessive stress and crack origin

Flight data recorder information

The ATSB's examination of the aircraft's flight data recorder (FDR) for the occurrence flight found that the left engine had surged as the aircraft passed through 10,240 ft. The engine pressure ratio (EPR) and engine rotational speed indications decreased abruptly, while the turbine gas temperature (TGT) for the engine began to increase. HPT vibration values for the engine increased from a level of 0.5 units before the failure to a maximum of 6.3 units over a three-second period. The manufacturer's high-limit for vibrations was 4.0 units.

The FDR readout indicated that the TGT for the engine continued to increase following the engine failure and remained at an indicated maximum of 1,149^oC for 1 minute and 46 seconds before decreasing (Figure 6). It is likely that the maximum TGT reached during the failure was higher than 1,149^oC, however the aircraft systems do not record above that temperature.

The FDR report indicated that there were no anomalies observed in the performance of the left engine prior to the failure.

Figure 6: FDR data plot of key engine parameters at the time of the failure

1. Metal pulverised by the turbine becomes molten and flows rearward attaching to the subsequent turbine and exhaust assemblies (US Department of the Air Force (1987). Safety Investigative Techniques (AF Pamphlet 127-1, Volume II. Washington DC: Author).
2. Bundesstelle für Flugunfalluntersuchung (BFU).
3. FAA AC 33-5, paragraph 5.c. definitions state '…Contained means that no fragments are released through the engine structure, but fragments may be ejected out of the engine air inlet or exhaust'.
4. Fatigue that occurs at relatively small numbers of cycles. Brooks, C. (1993). Metalurgical Failure Analysis. USA: McGraw-Hill, Inc.
5. The Life improvement Package 3 (LIP3) was a suite of HP Turbine modifications that included the HPT blade P/N BRH20351. The manufacturer introduced the package by SB-BR700-72-100801.

At 1435 Eastern Standard Time on 10 August 2004, a Boeing Company B717-200 aircraft, registered VH-VQA, was climbing to cruise altitude on a scheduled passenger service from Melbourne, Victoria to Hobart, Tasmania. As the aircraft passed through flight level 110, the crew heard a loud bang, with a corresponding increase in indicated left engine vibrations and the left engine began to spool down. The crew then shut the engine down in accordance with the operator's procedures and returned for a landing.

Post incident examination of the BR700-715 engine found metal fragments and metallisation in the exhaust area.

The engine was forwarded to the engine manufacturer for a detailed investigation that was supervised by a representative of the German Federal Bureau of Aircraft Accident Investigation. That investigation found that the engine failure was due the release of a single blade from Stage-1 of the high-pressure turbine (HPT), following the development of low-cycle fatigue cracking in its internal cooling passages. The manufacturer indicated that there had been four similar BR700-715 engine failures, with another engine failure under investigation.

Computer stress modelling, carried out by the manufacturer on the HPT blades, found stress levels in the blade's internal cooling passages, in the area of the occurrence blade's crack propagation, that were potentially in excess of the manufacturer's original design intent. The thickness of the vapour aluminised surface coating in the internal cooling passages was also variable. In certain operational conditions the coating could crack, with the subsequent growth of the crack into the parent material.

As a result of this and the other engine failures the operator and the engine manufacturer have completed a number of safety actions to prevent re-occurrence.

The Australian Transport Safety Bureau (ATSB) investigated this occurrence in accordance with the Transport Safety Investigation Act 2003, for the sole purpose of improving transport safety. It is not the object of an ATSB investigation to determine blame, provide a means of determining liability, or to assist in court proceedings between parties.

FACTUAL INFORMATION

Sequence of events

On 10 August 2004, the pilot of a Piper Aircraft Corporation PA-31-350 (Chieftain) aircraft, registered VH-MZV, was conducting a visual flight rules charter flight from Darwin to Bathurst Island¹ and return. The pilot was the only person onboard for the return to Darwin.

As the aircraft approached Darwin, air traffic control cleared the pilot to make a visual approach to runway 11. Recorded radar data indicated that at 5 NM the pilot turned onto the left base leg of the circuit at an altitude of about 1,000 ft. At about that time the pilot broadcast a Mayday², indicating that both engines had failed. He landed on tidal mudflats to the west of the airport.

Damage was sustained to the propellers and lower fuselage skins and bulkheads. The pilot was not injured.

The pilot recalled that the flight from Bathurst Island had been normal and that he had leaned the engines during the cruise at 3,500 ft. Turning onto the base leg, he reduced airspeed, extended the first stage of flap, lowered the landing gear and completed the pre-landing checklist. As the aircraft's speed reduced, the pilot moved the throttle controls forward, but neither engine responded. There was no significant yawing or rolling associated with the power loss. The pilot considered that both engines lost power simultaneously without any surging, misfiring, rough running or abnormal vibrations. He checked the position of the fuel tank selectors, confirmed that the mixture controls were positioned to full rich, and that the fuel boost pumps and magnetos were on. When those actions did not restore engine power, the pilot retracted the landing gear and concentrated on landing on the mudflats.

Aircraft examination

In accordance with normal procedures, the Australian Transport Safety Bureau (ATSB) placed a protection order³ on the aircraft to preserve the physical evidence while investigators travelled to Darwin. Staff from the Darwin office of the Civil Aviation Safety Authority attended the site and supervised, on behalf of the ATSB, the relocation of the aircraft from the tidal mudflats to dry land. That necessitated removal of the engines from the airframe, and each was separately lifted out by helicopter. The aircraft and its engines were cordoned off at a vacant block of land and a security guard was in attendance until investigators examined the aircraft.

The propellers had continued to windmill after the engines failed, operating the engine-driven hydraulic pumps, which provided hydraulic pressure to enable retraction of the landing gear.

Both propellers exhibited damage consistent with little or no power being produced by the engines during the wheels-up landing. Neither propeller had been feathered. The wing flaps were not extended.

The quantity of fuel contained in each inboard tank was not sufficient to enable the tank contents to be visually assessed through the filler neck. Fuel from the inboard tanks would not flow under gravity from the engine firewall fuel line fitting when the fuel line was disconnected. A check of another Chieftain fuelled to a similar quantity confirmed that this was a normal characteristic of the fuel system design.

A total of approximately 236 L of fuel was recovered from the aircraft's fuel tanks, which comprised 101 L from the left inboard tank (main), 105 L from the right inboard tank (main) and about 15 L from each outboard tank. Each inboard tank had a capacity of 212 L, including about 11 L unusable. The capacity of each outboard tank was 152 L, including about 8 L unusable.

Inspection of the fuel system confirmed the correct operation of the fuel selector controls, the fuel filters were clear of contaminants and the tank venting system functioned normally. No water or other contaminant was recovered from the fuel system drains and collector points. There was no evidence to indicate that fuel had been lost from the aircraft during flight.

Inspection of the engines and their systems did not identify any defect that may have influenced the circumstances of the occurrence. The engines and their accessories operated normally in an engine test stand.

Fuelling records

Trip and fuelling records indicated that the inboard fuel tanks were fully fuelled (capacity 402 L usable fuel) during the morning of 9 August 2004. Fuel consumption of 180 L was recorded during a subsequent two-sector return flight of 1.1 hours duration and 222 L of fuel remained in the inboard tanks. That pilot reported that he did not use the outboard tanks during those flights.

The occurrence pilot requested that the aircraft be refuelled with 80 L on the morning of the occurrence. Fuelling records indicated that this fuel was delivered to the aircraft. The pilot estimated that after refuelling, the inboard tanks contained about 300 L, sufficient fuel to complete the return flight to Bathurst Island.

The aircraft had flown 0.6 hours since departing Darwin and was completing the second sector at the time of the occurrence. Based on the trip records and the calculated fuel consumption, the aircraft main tanks should have contained about 160 L.

The pilot reported that on the day of the occurrence he did not operate either tank on 'crossfeed'⁴, nor did he select the outboard tanks.

Fuel testing

Laboratory analysis of fuel samples from the aircraft's fuel tanks confirmed that the fuel complied with the relevant specifications for AVGAS 100. Although minor traces of water and fine particulates were detected, that sample was obtained from a fuel line disconnected during recovery of the aircraft. The quantity of those contaminants was not significant.

Descent profile

Analysis of the radar data indicated that the aircraft's descent profile was normal until reaching left base for runway 11. Soon after the turn onto the base leg, the aircraft's groundspeed reduced significantly, and the rate of descent increased. The final descent to the emergency landing area took about 1 minute.

Data from the aircraft manufacturer indicated that the aircraft's glide ratio was approximately 12.5:1 and accordingly, from a height of 1,000 ft, the aircraft could glide about 2 NM.⁵ The investigation concluded that the aircraft was not within gliding range of the airport when the engines failed.

Operational information

The pilot had logged approximately 1,000 hours on PA-31 type aircraft. The pilot also regularly operated the company's Embraer E110-P1 Bandeirante aircraft in single pilot operations. The pilot's practice was to select the Bandeirante's engine fuel condition levers to LO IDLE during his pre-landing checks. The configuration of those engine controls was similar to that of the Chieftain's fuel mixture controls. Moving the Chieftain's mixture controls to a position consistent with LO IDLE for a Bandeirante would stop the flow of fuel to both engines and result in a sudden and complete loss of engine power.

1. Bathurst Island is located approximately 40 NM north-west of Darwin.
2. Mayday is an internationally recognised call for urgent assistance.
3. A protection order is issued under the provisions of section 45 of the Transport Safety Investigation Act 2003 for the purpose of protecting evidence that might be relevant to an investigation.
4. Crossfeed describes an abnormal operating configuration, where fuel from tanks on one side of the aircraft is provided to the opposite engine, therefore operating both engines from the same tank of fuel.
5. In nil wind, at the airspeed for best glide, wheels and flap retracted and propellers of both inoperative engines feathered.

SIGNIFICANT FACTORS

1. The wiring for the pilot’s control wheel horizontal stabiliser trim switches was reassembled in the reverse sense.
2. The maintenance manual post-maintenance functional test requirements for the horizontal stabiliser trim switches, which would have identified the reversed trim were not clearly noted by the manufacturer in the chapter that was referred to by the engineers for this task.
3. The post-maintenance duplicate inspection requirements in accordance with Civil Aviation Regulation (CAR) 42G were not included in the maintenance worksheets for the horizontal stabiliser trim system prior to release of the aircraft for flight and therefore were not performed or certified for.
4. The post-maintenance functional test that was performed by the engineers did not meet the intent of CAR 42G duplicate inspection criteria, in that the functioning of horizontal stabiliser trim switches did not include correlation of the horizontal stabiliser surface motion to trim switch movement.
5. Pre-flight inspection by the flight crew did not detect the reversed trim motion.
6. Having identified a problem with the pitch trim, the flight crew did not select stabiliser trim control from the pilot to the co-pilot control wheel during the occurrence flight.

ANALYSIS

The control difficulties experienced by the crew shortly after departure could be attributed directly to the horizontal trim system operating in the reverse travel sense to that commanded by the pilot in command’s (PIC) inputs to the horizontal stabilizer trim switches.

The investigation determined that systemic failures present during maintenance allowed the aircraft to be returned to service with a horizontal stabiliser trim system that operated in the reverse sense. Further, this incorrect flight control function was not detected during the pre-flight inspection by the flight crew.

A task that was maintenance intensive and/or extended over several shift periods involving numerous personnel required careful management in the co-ordination of effort to ensure every requirement was addressed to safely return the aircraft to an airworthy condition. In this incident there was a breakdown in this defence through absent or poorly defined handover procedures, documentation and co-ordination of the maintenance.

Disturbance of a flight control system during maintenance triggers the requirement for an additional layer of defence in the duplicate inspection procedure. In this incident the engineers were unsure of when the procedure was to be employed and this lead to a breakdown of the defence. A clearly defined procedure in the company maintenance control manual for invoking the duplicate inspection would have ensured a duplicate inspection was prescribed, which in turn should have identified the trim reversal prior to the aircraft’s release to service.

The aircraft provided the crew with an aural alert system with a known difference from its fleet siblings. The perception by the pilot in command (PIC) of the aircraft being inherently different, combined with a loading distraction at the critical trim function check time in the pre-flight sequence, probably led to a misinterpretation by the PIC of his response to the anomaly.

Once airborne and with the emergency in progress, the PIC established that he had control but neglected to consider selection of the trim system control to the copilot’s control wheel as an option. This may have been as a result of his decision not to manipulate the trim system any further due to possible mechanical failure.

FACTUAL INFORMATION

History of the flight

At 1100 Western Standard Time on 2 August 2004, a Fairchild Industries Inc. Metro 23 aircraft, registered VH-HWR, departed Perth on a scheduled passenger service to Kalbarri, WA. with two crew and nineteen passengers. Normal trim inputs were made by the pilot in command (PIC) during the departure and initial climb. He reported that at about the time the flaps were retracted, the control forces increased nose upward in the pitch axis.

The PIC reported that he looked at the horizontal-trim indicator and noticed a large deflection, but did not initially relate this to the control problem or identify the indicator deflection as abnormal. Rather, the PIC assumed that the problem related to the flap retraction, and he instructed the copilot to reselect the flaps to the take-off position, but this appeared to have no effect. The PIC did not attempt to switch electrical control of the aircraft's pitch trim system to the co-pilot's control using the pedestal mounted selector switch. He reported that the control forces required to maintain straight and level flight were very high and fatiguing, and he elected to fly the aircraft in this configuration back to Perth Airport.

A subsequent engineering examination revealed that the pilot in command's (left side) control yoke pitch trim switch had been wired incorrectly and that the left side pitch trim system was operating in the reverse sense from normal operation.

Flight data recorder information

The aircraft was fitted with a solid-state flight data recorder (SSFDR). The parameters recorded by the SSFDR included pitch and roll attitude angles, indicated airspeed, pressure altitude, magnetic heading and stabiliser position. Control column position was not recorded on the SSFDR.

This data was compared with the data readouts from the previous flight, and also to the flight following the incident flight. This comparison showed that stabiliser movement during the incident flight differed from that observed during the comparison flights. During the incident flight, following rotation, the stabiliser moved in an aircraft nose-up direction only. In the comparison flights, following climb out, the stabiliser moved in the opposite sense or a nose-down direction.

Aircraft maintenance

Prior to the incident, the aircraft had undergone maintenance for the flight controls being heavy in the roll (aileron) axis. The problem was traced to a binding bearing in the left side control yoke. To access the bearings, it was necessary to remove the control yoke and the control yoke pitch trim switch by de-soldering the switch wiring and removing the switch from the yoke housing. After the control column bearings were replaced, the control yoke was re-installed, and the trim switch wiring was re-soldered to the respective terminals. During this task, the wiring labelling was misread and the trim switch wires were inadvertently transposed, which would result in the trim switch operating in the reverse sense when activated. The trim switch was then re-installed into the control yoke. There were no markings or labels on the control yoke or the trim switch to indicate trim up or down.

During the aircraft maintenance activity, there were a number of different maintenance engineers involved over several shifts. The handover between the shifts was completed through the use of a shift handover book and details of the aircraft's pitch trim system wiring information was not referred to the incoming shift engineers through the handover book.

Aircraft maintenance manual and post maintenance trim switch functional test

The aircraft operator's maintenance worksheets recorded that the task to remove and replace the control yoke bearing was accomplished in accordance with the Fairchild Aircraft Maintenance Manual (FAMM) Section 27-10-10. This section contained maintenance steps to be followed in relation to the removal and refitting of the control yoke and control yoke switches. However, it contained no reference to a following section, 27-40-01, that detailed the removal and installation procedures for the pitch trim control switches. That procedure included the following note in relation to the operational check of the trim switch:

Pushing switch UP moves horizontal stabilizer toward NOSE DOWN direction;
pushing switch DOWN moves stabilizer towards NOSE UP

Civil Aviation Safety Authority requirements

The Australian Civil Aviation Safety Authority (CASA) promulgated specific inspection requirements for flight controls in Civil Aviation Regulation 42G. Those requirements are for the inspection and functional checks of any part of an aircraft flight control system that is assembled, adjusted, repaired, modified or replaced in the course of carrying out maintenance on an aircraft. In these cases, the flight control system must be inspected by the person who carried out the work and additionally by an independent person.

During the maintenance activities to the aircraft prior to the incident, several tasks were performed that required a duplicate inspection in accordance with the CASA requirements. An examination of the aircraft maintenance records indicated that two duplicate inspections were omitted, including one for the left side control yoke wiring reconnection. A review of the aircraft operator's maintenance control and engineering procedures manual indicated that this requirement was not clearly defined. In addition, in this occurrence, engineers reported that they were unsure of when such a procedure was to be employed.

Pre-flight actions by the flight crew

The PIC stated that he had performed the pre-flight cockpit checks while the copilot conducted the aircraft external checks. He stated that he had performed a daily trim check in accordance with the approved flight manual, during which he said he noticed something was 'not quite right'. He stated that one pilot's trim switch activated the sonalert¹ aural warning system, while the other remained silent. The aural warning system in this aircraft was known to have activation characteristics that were different from the rest of the operator's aircraft fleet, and this was in his mind when he discussed the issue with the copilot. However, he was then distracted by a baggage loading issue and did not return to the perceived discrepancy prior to take-off.

Previous occurrences

The ATSB investigated a similar previous incident that occurred on 22 March 2004, involving a different operator (see ATSB report BO/200400998) in which the pitch trim switch had been incorrectly re-installed into the control yoke of a Fairchild Industries Inc. Metro 23 aircraft, resulting in the operation of the pitch trim switch in the reverse sense. As a result of that and other similar occurrences, CASA advised the US Federal Administration of the occurrences and published an article titled Nose up, nose down regarding trim switches in the November/December 2004 issue of Flight Safety Australia magazine. The article analysed the cause of those failures and highlighted the importance of maintaining switches and following correct procedures to prevent similar occurrences.

1. Sonalert - When pitch trim actuation is detected a tone generator emits an audible low frequency sound in the cockpit to alert the crew when the stabiliser trim is in motion.

The number 4 engine in-flight failure was the result of the failure of the high-pressure compressor rotor, number 1 bearing, due to insufficient lubrication. The lack of lubrication was the result of leakage past the two damaged 'O' rings on the perimeter of the number 3 bearing package support assembly, and the blockage of an oil jet in the package support that supplied oil to the front side of the number 1 bearing.

It is probable that the two 'O' rings were damaged during installation while the new carbon seals were being fitted on 24 December 2003.

On 28 July 2004, a British Aerospace PLC, BAe 146 aircraft, registered VH-NJA, was in cruise flight at flight level (FL) 280, on a scheduled passenger service from Brisbane to Adelaide. At 1245 EST, the flight crew (crew) felt and heard a light to moderate rumbling and grinding noise.

A check of the aircraft and engine instruments indicated that the number 4 engine had a rapidly decreasing N1¹ RPM and an N2² RPM of less than 10%. The turbine gas temperature (TGT) for that engine appeared to indicate zero and the thrust management system (TMS) showed an error message and a 'Test Fail' indication.

The crew shut the engine down in accordance with the operator's abnormal checklist procedures and turned off the TMS. A fire bottle was discharged into the number 4 engine cowling area as a precaution.

The crew informed the cabin crew of the engine failure, with one of the flight attendants reporting having seen sparks coming from the engine.

The crew contacted air traffic control (ATC) requesting a descent to FL150 to start the auxiliary power unit (APU). The passengers were also advised that a generator failure had occurred. The air traffic controller later contacted the crew asking if operations were normal. At that time, they informed ATC that the engine had failed and that they were continuing to Adelaide. The crew advised that they would not be declaring an emergency.

After starting the APU, the crew climbed the aircraft to FL240 and continued to Adelaide.

The failed ALF502R-5(-103A) engine, serial number LF05932, was removed from the aircraft and forwarded by the Australian Transport Safety Bureau (ATSB) to the engine manufacturer in the US. An investigation of the failed engine was carried out by the engine's manufacturer in August 2004, with a representative of the US National Transportation Safety Board present on behalf of the ATSB.

The investigation found that the engine failure resulted from the failure of the high-pressure compressor rotor, number 1 bearing, due to high temperature damage resulting from insufficient lubrication. The number 1 bearing was located in the stub frame mount in the engine's gas producer module (see diagram).

Lubricating and cooling oil was supplied to the bearing via two jets: one each for the front and rear of the bearing.

Oil was ported to the two oil jets through galleries located in the number 3 bearing support assembly. The oil supply galleries and jets were sealed by two 'O' ring packings that were positioned on the outside diameter of the number 3 bearing support assembly.

Examination of the number 3 bearing package support assembly found that both 'O' rings on the outside diameter of the support had multiple 'nibbles' (small missing pieces) around their circumference. The forward 'O' ring had also been cut completely through. Sectioning of the number 3 bearing support found that the oil jet that supplied lubrication to the front of the number 1 bearing was also blocked with 'O' ring material. Analysis of that material found it was consistent with the missing pieces of 'O' ring from the outside of the number 3 bearing package support.

The engine manufacturer estimated that leakage past the damaged 'O' ring and the blocked oil jet had reduced the lubricating and cooling oil supply to the number 1 bearing by approximately 50 to 60 percent. The report further indicated that all other engine damage noted had resulted from the failure of the number 1 bearing.

The ATSB determined that the number 3 bearing package support was last removed from the engine by the aircraft operator during maintenance on 24 December 2003. The bearing package support had been removed to facilitate the fitment of new carbon seals to the number 1 and number 3 bearings. During that maintenance, both 'O' rings on the support were replaced. At the time of the engine failure, the engine had completed 975 hours and 706 cycles since that maintenance. Information from the operator indicated that there had been no history of excessive oil usage or excessive vibration on the trend graphs for the engine.

1. N1 (NL) engine low pressure turbine and fan RPM.
2. N2 (NH) engine high pressure compressor and turbine RPM

On 28 July 2004, a British Aerospace PLC, BAe 146 aircraft, registered VH-NJA, was in cruise flight at flight level (FL) 280, on a scheduled passenger service from Brisbane to Adelaide. At 1245 EST, the flight crew (crew) felt and heard a light to moderate rumbling and grinding noise.

ANALYSIS

The circumstances of the accident are consistent with dynamic rollover occurring after the right wheel penetrated the helipad surface and acted as a pivot point about which the helicopter rolled. As the helicopter rolled, the main rotor blades contacted the walkway. Because the timing and order of the events that occurred during the rollover were not available, a detailed analysis of the accident sequence was not possible. However, the pilot's response of applying opposite cyclic control, but not lowering the collective pitch control when the helicopter began to roll was not the most effective method of preventing the development of the rollover. Whether the rollover may have been prevented and/or the consequences limited had the pilot lowered the collective pitch control was not able to be determined.

The pilot did not establish before the landing that the load capability of the helipad was appropriate to the requirements. He appeared to have two bases to support his decision to operate the Agusta A109C onto the helipad. One was that neither the helipad owner, nor CASA, had told him that he could not. Such reasoning was inadequate and demonstrated a low level of risk awareness. The second was that other helicopters of operating weight similar to the Agusta A109C had used the helipad. That reasoning was also inadequate because it did not take into account that those helicopters were skid-equipped, and would not subject the helipad deck to the point loads that would exist with the Agusta A109C. It demonstrated an inadequate level of knowledge.

The location of the deck failure was where the plywood would be subject to the greatest bending for a given load, and consequently, where a failure was most likely to occur. The potential for a similar failure would have been present since changes were made to the plywood sheeting size and grade. However, variability between factors such as helicopter wheel positions, dynamic movement of the helipad, and the pilot's flight control inputs would have changed the effect on the deck of each landing. It is likely that the crack in the underside of the plywood in the area of the deck opposite the failure location was an example of the effect of those factors during a previous landing by the helicopter.

Documentation regarding maintenance of the helipad indicated that the installation of the smaller size sheeting most likely occurred during repairs that were completed in September 2000. At that time, other than by way of the design drawings prepared in 1984, full-width plywood sheeting was not specifically addressed either by the oversighting government department or the contractor conducting the repairs.

The strength of the helipad deck compared with the load imposed by the helicopter can be demonstrated from the following information:

It is apparent that the strength of the plywood used in the decking (61 MPa) was approximately 12 times greater than required by the design (5.138 MPa). By comparison, the load applied by each main wheel (928 kg) was approximately 13 times greater than the design load (73 kg per panel).

It is unlikely that the helipad owner calculated the load bearing capability of the helipad with respect to specific helicopters that used the helipad, or their type of landing gear. In particular, the reason for the 2,000 kg load limit, as advised to users of the helipad, appears to be unsubstantiated. The potential for the plywood to be subjected to point loads by helicopter wheels, was not taken into account during the design of the replacement deck. Together with the dynamic movement of the deck by wind and wave action, that effect would have significantly increased the effective ratio of wheel loading to deck design load.

The load limit issues, the installation of plywood deck sheeting of size inappropriate given the existing supporting structure, and the poor condition of some areas of the deck indicated shortcomings in the maintenance and management oversight of the helipad.

Prior to April 2004 there was apparently no awareness within the helipad owner's organisation of the significance of helicopter landing gear configuration to the load bearing capability of the helipad. Nor were there indications that the owner was aware of CAAP 92-2(1), or the guidance it contained. It is likely that those issues were unrecognised due to a lack of aviation technical expertise within the helipad owner's organisation.

CONCLUSIONS

Factors

1. Management and maintenance of the helipad did not encompass all the aspects necessary to ensure that the actual load bearing capability of the helipad, including for skid and wheel type landing gear equipped helicopters, was known.
2. The actual load bearing capability of the helipad was less than that required for safe use by the Agusta A109C helicopter.
3. The pilot did not check before the flight, whether the helipad was capable of safely accepting the loads imposed by the Agusta A109C helicopter.

FACTUAL INFORMATION

History of the flight1

On 30 July 2004, at about 1120 Eastern Standard Time, an Agusta A109C helicopter, registered VH-ZZN, was being operated on a private flight from the Gold Coast to Brisbane Airport via the Brisbane River Helipad. The pilot and two passengers were on board. The intention was to disembark one of the passengers at the helipad, without shutting-down the engines, and then to continue the flight to Brisbane Airport.

The pilot reported that he established the helicopter in a low hover above the helipad and was satisfied that it was correctly positioned above the painted white landing circle. He then allowed the wheels to settle on the helipad, with the right side of the helicopter facing the river bank. The pilot said that he kept his left hand on the collective pitch control lever and his feet on the tail rotor pedals. He then gripped the cyclic control with his knees so that he could open the cockpit door with his right hand. He leaned out and checked that the helicopter was centrally positioned in the landing circle and that the right main wheel was not causing any visible stress to the helipad surface. He then applied the parking brake and closed the door before telling the passenger to disembark through the right cabin door.

The pilot recounted that when the passenger was safely clear of the helicopter, he applied a small amount of collective pitch control in preparation for lift off. He then felt the helicopter lurch and begin to roll right. The pilot immediately applied full left cyclic pitch control and maintained the collective pitch control position. However, the helicopter continued to roll rapidly right and the main rotor blades struck the walkway safety rails. The helicopter came to rest inverted between the helipad and the riverbank, with the forward fuselage against the junction between the helipad and the connecting walkway.

The helicopter was not fitted with a flight data recorder or cockpit voice recorder, nor was it required to be by relevant aviation regulations. Consequently, there was no information available regarding the events or timing of the accident sequence, including the rate of helicopter movement and any control inputs made by the pilot.

Injuries to persons

The pilot and passenger received minor injuries but were able to egress from the helicopter unassisted.

Damage to the helicopter

The helicopter was substantially damaged during the rollover sequence. Contact with the walkway destroyed the main rotor blades and damaged the forward fuselage. The fuselage was partly immersed in water. There was no fire.

Debris from the helicopter was found up to 200m from the helipad, both on and adjacent to the pedestrian/bikeway on the riverbank. There was potential for debris to have been thrown onto the adjacent road complex.

Other damage

Initial examination of the helipad revealed that the helicopter's right main wheel had broken through the deck sheeting on the edge of the white painted landing circle (Figure 1). See also page 7, 'Helipad examination'.

The helicopter's main rotor blades caused substantial damage to the walkway linking the pontoon to the riverbank.

Figure 1: The helicopter as it came to rest. The arrow points to the location of the deck surface failure

Pilot in command

The pilot, who was the chief pilot of the organisation that operated the helicopter, held a valid commercial pilot licence (helicopters). His total flying experience (all rotary wing) was 1,720 hours, of which approximately 250 hours were on the Agusta A109C type (all on VH-ZZN).
The pilot had operated onto the Brisbane River Helipad on numerous occasions since 1 July 2003 in Hughes 500 and McDonnell Douglas 600 type helicopters, and on 19 occasions in the Agusta A109C type2.

Aircraft information

The Agusta A109C was a twin turbine-engine helicopter capable of carrying up to seven passengers. Its maximum operating weight with an internal load was 2,720 kg. The helicopter was equipped with a retractable landing gear, which comprised a nose wheel and two main wheels.

The estimated weight of the helicopter at the time of the accident (including approximately 300 L aviation turbine fuel) was 2,471 kg. Under those conditions, and taking account of the centre of gravity position, the static load on each main wheel was about 930 kg.
According to documentation provided by the operator, there were no outstanding maintenance requirements for the helicopter at the time of the accident. The pilot reported that the helicopter was operating normally in the period prior to the accident.

Brisbane River Helipad

The 9.4 m square helipad was owned and administered by the Queensland State Government. It was located adjacent to the northern bank of the Brisbane River at the end of Margaret Street in Brisbane City (Figure 2). It was mounted on a tethered floating pontoon that was linked to the riverbank by an 11 m walkway. Safety rails approximately one metre high were attached to either side of the walkway. There was a pedestrian pathway and motor vehicle road infrastructure along the riverbank adjacent to the helipad.

Figure 2: The Brisbane River Helipad location

Documentation relating to the operation and maintenance of the helipad was contained in separate files that were administered by various Queensland State Government departments and branches of departments during the period 1981-2004. Through most of that time, operational control and maintenance responsibility for the helipad were held by separate departments, with maintenance aspects being handled predominantly by the department that had responsibility for maritime safety and/or harbours and marine. No record was found on the files of the original design criteria for the helipad, including the helicopter type(s), operating weights, and type of landing gear (skid or wheels) for which it was intended to be used.

Helipad examination

The helipad deck (Figure 3) consisted of 1,200 mm x 2,400 mm plywood sheeting nailed to 100 mm x 75 mm hardwood joists 600 mm apart. The joists were attached to a series of aluminium 'I' beams mounted on two pontoons. The longer (2,400 mm) sides of the plywood sheets had tongue and groove edges and butted over the approximate mid-point of every alternate joist. The shorter (1,200 mm) sides of the plywood sheets did not have tongue and groove edges and were not structurally connected. There was no supporting structure beneath those sides except at the midpoint position at the location of a joist. The central area of the helipad surface (where the helicopter landed) appeared to have been in relatively good condition.

Figure 3: After removal of the wreckage. Individual plywood decking sheets are evident. The arrow points to the location of the deck failure

Figure 4: Location of the deck failure and its relationship to the supporting framework

The location of the deck failure coincided with the corner of one of the plywood decking sheets (Figure 4). The nature of the failure was consistent with the right wheel of the helicopter bearing down on the plywood sheet midway between two adjacent joists, and near the edge of the sheet. The edge formed the shorter (1,200 mm) side of the sheet and was not structurally connected to the adjacent sheet edge.

Specialist examination concluded that the final failure occurred at the point of highest bending moment between the joists. The individual layers within the decking sheet all failed at the point of highest bending, suggesting that the plywood adhesive and the timber layers had not deteriorated due to water ingress.

Laboratory tests carried out on samples taken from the failed section of the deck revealed a bending strength of 61 megapascals (MPa). The size of the test samples was smaller than stipulated by the standard. However, that bending strength exceeded the bending strength of marine grade plywood3.

Examination of the underside of the deck revealed a significant longitudinal crack on the side of the deck opposite the failed section. The deck upper surface at that location showed no sign of damage. The crack displayed damage to the lower layers of the plywood midway between two longitudinal joists. The cracking was not adjacent to the edge of a plywood sheet and was not observed when the helipad was inspected in April 2004. Specialist assessment of the damage concluded that it was likely to have been caused by a point loading in the order of 1,200 kg.

Some areas of the deck on the river and upstream sides of the helipad were significantly degraded due to water ingress into the layers of the plywood, probably as a result of wave action. Examination of those areas indicated that both the ply adhesive and the wood itself had deteriorated significantly. Deterioration of that nature was consistent with continuous contact with, or immersion in, water for an extended period. Those areas, however, were not related to the occurrence.

Helipad load bearing capability

There were numerous references in the helipad owner's documentation regarding the pad's load bearing capability. The earliest of those appeared in drawings that were completed in 1984 for the installation of a new deck consisting of plywood sheets mounted on aluminium support beams (Drawing No. BN-5-43-1). The design strength of the replacement deck was based on a pressure of 3 kilopascals (kPa) evenly distributed over the entire deck area, although the origin of the selected value was not clear. A pressure of 3 kPa is equivalent to 306 kg evenly spread over each square metre of decking. The layout of the plywood sheets over the aluminium support beams resulted in a design panel size of 600 x 400 mm (0.24 sq.m), equivalent to 73 kg evenly distributed on each design panel. The designer's calculations showed that this loading would create a bending stress of 5.138 megapascals (MPa) in the plywood decking, which was well within the allowable working stresses for the F114 grade structural plywood selected for the repairs. There was no indication in the documentation that the design of the repairs included any consideration for point loads, such as would be experienced from wheel equipped helicopters.

In May 1982, a request to land a helicopter weighing up to 3,630 kg on the helipad was refused because 'it would be unsafe to place this weight on the helipad'. However, there was no supporting documentation for that statement.

A July 1997 document authorising a private operator to use the helipad included the statement that the applicant 'should be aware that there is a load limit for the HLS [helicopter landing site], and aircraft in excess of 1,400 kg should not access the HLS'. There was no information regarding the origin of that figure.

In late 1996, the Queensland Government commissioned a feasibility study by a town planning consultant on the future options for the helipad. The study, completed in late 1997, noted that there was:

… no evidence at hand which would indicate it's [the helipad's] safe load capabilities but it appears to be beyond the operation of the Queensland Emergency Services helicopter - a Bell 412 with a maximum take-off weight approaching 5,400 kg - but comfortably accommodates most small to medium-sized turbo driven helicopters in use in the region. The practical limit appears to be approximately 3,000 kg.

There was no supporting evidence to indicate how that conclusion was reached.

In March 1997, there was internal correspondence regarding the establishment of a deed of indemnity that was to apply to users of the helipad. A deed was developed and in early 1999 was sent to users of the helipad for signature. In June 1999, in response to a request to use the helipad, a list of 'requirements that apply to the use of the helipad' was included, for the first time, in the covering letter to the deed. Those requirements included the following:

1. The helicopter landing site is intended for the use by helicopters within the "small" utility class only i.e. helicopters up to 2,000 kg in mass, and
2. The permittee, or their nominated pilot, are responsible for ensuring that the helicopter landing site is in suitable condition before intended use.

There was no indication in the documents regarding the origin of those 'requirements'. Subsequently, there were other instances where prospective users of the helipad were provided with a copy of the requirements when they were asked to sign the deed of indemnity.

In April 2004, a helicopter operator not associated with VH-ZZN contacted the helipad owner requesting confirmation that an Agusta A109C helicopter could land on the helipad. The operator noted that the weight of the Agusta A109C was between 2,000 and 3,000 kg and that, because the helicopter was equipped with wheel instead of skid type landing gear, a 'wheel footprint' of about '1,200 kg per mainwheel' would exist. A reply was sent to the operator advising that the helicopter weight exceeded the 2,000 kg limit that formed part of the standard terms of use for the helipad. The operator replied, noting that skid equipped helicopters weighing greater than 2,000 kg, such as the AS350 Squirrel5, had landed on the helipad.

In May 2004, the Civil Aviation Safety Authority (CASA) contacted the helipad owner regarding the helipad. CASA requested the weight restrictions and the conditions of use of the helipad, and asked whether the weight limit was clearly marked on the helipad. That request, along with the earlier questions and information regarding the suitability of the helipad for the Agusta 109 helicopter, generated activity by the helipad owner including the proposal that a safety audit of the helipad be conducted as a matter of priority.

The justification for the proposed audit was that there may be safety issues associated with the helipad that were not being adequately addressed, such as appropriate usage and signage, and the proximity of the helipad to pedestrian and motor vehicle traffic adjacent to the helipad. At the time of the accident, those issues had not been progressed.

Helipad maintenance history

The helipad owner conducted major maintenance on the helipad in 1984, 1997, 2000 and 2004. In the intervening periods, minor maintenance was conducted. The maintenance activities generally involved work on the flotation pontoons, mooring chains, and the walkway linking the pontoon to the riverbank, and the helipad deck. For the purposes of this report, however, discussion of maintenance activities will focus on the helipad deck.

The drawings for the helipad prepared in 1984 (Drawing No. BN-5-43-1) indicated nominal deck dimensions of 9,400 mm x 9,400 mm and specified a series of hardwood plywood 'rot proofed' decking sheets 9,400 mm x 1,200 mm, with minimum stress grade F11.

At the commencement of the work phase of the repairs conducted in 1984, the contractor proposed standard size plywood sheeting 2,400 mm x 1,200 mm for the decking but that was deemed not acceptable by the helipad owner because the sheet size was not in accordance with the drawing specifications. Subsequently, a special order of 9,400 mm x 1,200 mm plywood sheeting was obtained. The repairs to the helipad, including the installation of the new 9,400 mm long plywood decking sheets on aluminium support beams, were completed in March 1985.

The major maintenance undertaken on the helipad in 1997 included the replacement of two plywood decking sheets and painting of the deck. The documentation indicated that the replacement plywood sheets were 9,400 mm long.

Inspection of the helipad in May 2000 revealed that, in addition to other items requiring rectification, most of the plywood decking was badly deteriorated and beyond repair. On 4 May 2000, the company that subsequently won the contract to conduct the repairs was asked to provide a price:

… to replace any damaged structural plywood sheeting of the deck of the helipad (both a price to replace each sheet and a price to replace all the sheeting). The plywood shall [be] in accordance with Drawing No. BN-5-43-1 and classified as Marine Grade Structural Plywood.

The contractor provided a price to remove and replace all sheets/deck and to coat all surfaces with a product that he stated would waterproof all surfaces and provide total protection to the pontoon/helipad for many years. The contractor was awarded the contract on 16 May 2000. Aside from the reference contained in drawing No. BN-5-43-1, the documents did not refer to the plywood decking sheet size. Documents dated early September 2000 indicated that the rectification works had been inspected as being completed. There was no confirmation in those documents regarding the grade of plywood or sheet size used on the deck.

Another inspection of the helipad was conducted in December 2003. Among the defects identified were four areas of deck sheeting that had loosened, and that the deck needed repainting. The pontoon was removed from the river in March 2004 and the repairs undertaken. There was no reference to any plywood deck panels or supporting beams being replaced during that work. The helipad was returned to service on 21 April 2004.

Operator's information regarding the helipad

The helicopter operating company's operations manual included a register of helicopter landing sites that were used by the company, and pertinent details regarding those sites. The Brisbane River helipad was included in that register. The register details included a caution note regarding river craft during approach and departure, and local pedestrian traffic during approach termination. The register contained no information regarding the load capability of the helipad.

An email dated 1 December 2003 was sent by the helipad owner to the company operating the helicopter regarding access by that operator to the Brisbane River Helicopter Landing Site. The email stated that the deed of indemnity applying to the operator was attached to the email along with:

a copy of the cover sheet that accompanies the Deed of Indemnity as this cover sheet provides details of access restrictions etc.

However, the investigation was unable to establish conclusively that details of the access restrictions had been attached to the email. The deed of indemnity, signed by the helicopter pilot under the company seal, was returned to the helipad owner by facsimile on 1 December 2003 under the signature of the company operations manager.

The pilot reported that he had not sought any information from the helipad owner regarding the load capability of the helipad and claimed that he was not aware that the helipad had a load rating. He stated that he had never seen any document regarding a load rating for the helipad and that the helipad owner had never advised him of a weight limit for operating on the helipad. His rationale for not seeking information regarding the load capability of the helipad was that both the helipad owner and CASA were aware that he was operating the helicopter onto the helipad and neither organisation had advised him against such operations. He had therefore presumed that it was safe to land on the helipad.

The pilot believed that a Bell 412 helicopter operated by the helipad owner had landed on the helipad, and that 'countless other helicopters of larger sizes' than the Agusta 109 had operated onto the helipad. (Personnel involved in the operation of the helipad owner's Bell 412 helicopters reported that they had never operated the Bell 412 helicopter type onto the Brisbane River helipad. No record was found to indicate that any helicopter larger than the Agusta 109, or any other wheel equipped helicopter, had landed on the helipad.)

Operator's procedures

The operator advised that its standard procedures for operating onto a marine helipad included the following after-landing checks:

• visually determine if the helicopter is actually centred on the heli-pad;
• visually observe the deck of the pad to make sure [sic] it is holding the aircraft well; and
• Apply the handbrake and allow passenger(s) disembarkation.

The pilot reported that he followed those procedures for all landings on helipads with both wheel and skid equipped helicopters, and did so on this occasion. In the case of the Agusta A109C, it was necessary to open the door to view below, and fore and aft of, the helicopter. When he checked after landing whether the right main wheel was causing any stress to the helipad surface, it was as part of his standard practice and not because he was unsure as to whether the deck would support the helicopter.

Regulatory aspects

The Civil Aviation Safety Authority issued the Civil Aviation Advisory Publication (CAAP) 92-2(1), in January 1996 titled Guidelines for the establishment and use of helicopter landing sites (HLS). The CAAP included the following introductory statement:

The information contained in this publication is advisory only. There is no legal requirement to observe the details as set out. The Civil Aviation Regulations detail the legal requirements that must be complied with in relation to use of areas for takeoff and landings by a helicopter. While there may be a number of methods of ensuring that the requirements of the Civil Aviation Regulations are met, this CAAP sets out criteria which ensures compliance with the regulations. The CAAP must be read in conjunction with the Civil Aviation Regulations.

The following text appeared under the heading 'Purpose of this CAAP':

Civil Aviation Regulation 92 (1) states that: "an aircraft shall not land at, or take-off from, any place unless: … (d) the place …. is suitable for use as an aerodrome for the purposes of the landing and taking off of aircraft; and, having regard to all the circumstances of the proposed landing or take-off (including the prevailing weather conditions), the aircraft can land at, or take-off from, the place in safety."

Regulation 92 (1) does not specify the method of determining which "circumstances", other than the prevailing weather conditions, should be considered in any particular case. These matters are the responsibility of the pilot in command and, in some circumstances, are shared with the aircraft operator.
These guidelines set out factors that may be used to determine suitability of place for the landing and taking off of helicopters. Experience has shown that, in most cases, application of these guidelines will enable a take-off or landing to be completed safely, provided that the pilot in command:
• has sound piloting skills; and
• displays sound airmanship.

Under the heading 'Factors that should be considered prior to using an HLS', the CAAP stated, in part, that:

The pilot of the helicopter operating to, from or at an HLS should ensure that:
• the HLS is clear of all:
- persons, other than persons essential to the helicopter operation; and
- objects and animals likely to be a hazard to manoeuvring the helicopter, other than objects essential to the helicopter operation; and
• no person outside the helicopter, other than a person essential to the operation is within 30 m of the helicopter; and
• appropriate permission from the owners and authorities has been given.

The CAAP also listed recommended criteria for two types of HLS - Basic and Standard.

The CAAP defined a basic HLS as 'a place that may be used as an aerodrome for infrequent, opportunity and short-term basis for all types of operation, other than RPT, by day under helicopter VMC6'. The criteria for a basic HLS included that it should be large enough to accommodate the helicopter safely and should have a surface capable of withstanding the static and dynamic load imposed by the helicopter.

The CAAP defined a standard HLS as a place that may be used as an aerodrome for helicopter operations by day or night. The recommended criteria for a standard HLS were more comprehensive than those for a basic HLS.

Documents from the helipad owner revealed that in 1992 the question arose as to whether the helipad complied with the then Civil Aviation Authority (CAA) regulations. In 1994, that issue was raised again and there was concern that if the helipad was moved a further 11 metres away from the riverbank to comply with CAA regulations, such action could conflict with the requirements of the Harbours Act.

The consultant undertaking the feasibility study commissioned in late 1996 advised the helipad owner at that time that the CAA requirement impacting on the distance of the helipad from the riverbank had been removed, and that it was now up to the pilot to determine the suitability of a particular location for landing.

The consultant's report, completed in October 1997, expanded on the advice given in late 1996 and discussed some aspects of CAAP 92-2(1). The study noted that 'the type of HLS to be authorised for use at this site under the Civil Aviation Regulations is a little obscure but would appear to fit the 'Marine HLS' model'. The study concluded that the 'existing facility' did not conform to the Marine HLS criteria due to the proximity of the adjacent infrastructure. The study did not address the basic or standard HLS load bearing criteria contained in the CAAP. There was no evidence on the files examined that there had been any follow-up by the helipad owner regarding the criteria of the helipad against those of the CAAP.

Dynamic rollover

A phenomenon known as dynamic rollover can occur during helicopter operations. It arises when the helicopter is placed in a situation where it is pivoting or rolling around a wheel or skid that is in contact with a fixed object.

Dynamic rollover can occur during or prior to the hover when any part of the helicopter acts as a pivot and the helicopter exceeds a critical angle of roll. This angle is dependant upon control limits and, in most helicopters, is in the order of 15 degrees.

Rough ground or obstructions that pin a wheel or skid to the ground can contribute to dynamic rollover. Several rollover accidents have been caused by hitting an obstruction with the landing gear or by attempting a take-off with an obstruction next to the gear.

Regardless of rotor design, actions needed to correct a roll rate are the same and should be instinctive: simultaneously reduce collective and adjust cyclic to maintain lateral trim.7

Once started, dynamic rollover cannot be stopped by application of opposite cyclic control alone. For example, if the right skid or wheel of a helicopter contacted an object and became the pivot point while the helicopter started to roll to the right. Even with full left cyclic applied, the main rotor thrust vector and its moment would follow the aircraft as it continued rolling to the right. Quickly applying down collective is the most effective way to stop the development of dynamic rollover. The phenomenon can occur in both skid and wheel equipped helicopters, and all types of rotor systems.8

Dynamic rollover has been identified in Australia9 and overseas as a contributing factor in helicopter accidents.

The helicopter manufacturer advised that the critical dynamic rollover angle for the A109C had not been determined. The static lateral rollover limit for the helicopter was 27.8 degrees at minimum flight weight (the most critical condition). The maximum slope from which the helicopter was able to takeoff and land with adequate safety margins was 10 degrees.

1. Only those investigation areas identified by the headings and subheadings were considered to be relevant to the circumstances of the occurrence.
2. The Hughes 500 and McDonnell Douglas 600 were small utility type helicopters whose normal maximum operating weights were less than 2000 kg. Both were equipped with skid type landing gear.
3. Table B1 of AS/NZS 2272 1996 Plywood Marine stated that 'The stress grade of plywood manufactured to this standard is a minimum of F14. The sectional properties, if required, shall be calculated by the method specified in AS/NZS 2269'. Table 4.1 of AN/NZS 2269 Plywood-Structural stated that the characteristic bending strength of F14 plywood was 40 MPa.
4. 'Stress grade' refers to the classification of a piece of timber to indicate, for purposes of structural design, a set of basic working stresses and stiffness appropriate to that piece. The grade is designated by a number preceded by the letter F eg. F8. The letter stands for "force" and the number is the amount of stress, in megapascals, that the timber will withstand without bendin beyond acceptable limits in a test situation.
5. It was reported that a single-engine Eurocopter Squirrel helicopter, which had a maximum all-up weight of 2,100 kg and a twin-engine Eurocopter Squirrel helicopter, which had a maximum all up weight of 2,540 kg had operated onto the Brisbane River Helipad. However, the operating weights of the helicopters on those occasions were not established.
6. Visual Meteorological Conditions (VMC) define the in-flight conditions (visibility and distance from cloud) under which aircraft should operate to conduct flight under the visual flight rules (VFR).
7. Rotorcraft Dynamic Rollover. A new look at the problem. Flight Safety Australia, April 1999.
8.Rotorcraft Flying Handbook (FAA-H-8083-21) 2000, Federal Aviation Administration, Flight Standards Service.
9.ATSB report 200300982.

The pilot landed the helicopter on the Brisbane River Helipad to disembark a passenger. As the pilot prepared to lift off, the right main wheel penetrated the pontoon deck, causing the helicopter to capsize. The circumstances were consistent with dynamic rollover. The pilot did not lower the collective pitch control (the recommended response to dynamic rollover) when the helicopter began to roll.

The helipad consisted of a plywood deck mounted on a framework that formed a floating pontoon moored to the river bank. Prior to the flight the pilot had not checked the load bearing capability of the deck, but assumed that the helipad was capable of accepting the Agusta 109 helicopter. Examination revealed that the point load imposed by the main wheels of the helicopter was close to the tested strength of the plywood pontoon decking material. The additional dynamic load effects due to helicopter movement, and wind and water action, were likely to have increased the loads on the deck surface, causing failure of the plywood.

Documentation relating to the management and maintenance of the helipad revealed that the actual load bearing capability had never been established. Potential users of the helipad had been advised of a load limit of 2,000 kg, although the origin of that figure was unknown. The pilot claimed that he was not aware of that limit.

The engineering drawings for the deck called for plywood sheets that extended the full width of the deck. However, smaller sheets were used when the deck surface was last replaced. That had the effect of introducing weaker areas where sheet ends butted together but were unsupported. The deck failure occurred at one of the sheet ends.

On 28 July 2004, a Piper PA-31T Cheyenne, VH-TNP, with one pilot and five passengers, on a private, instrument flight rules flight from Bankstown to Benalla, collided with terrain 34 km south-east of Benalla. All occupants were fatally injured, and the aircraft was destroyed by impact forces and fire. Instrument meteorological conditions existed at the time and the pilot had reported commencing a Global Positioning System (GPS) non-precision approach (NPA) to Benalla.

The experienced pilot was familiar with the aircraft and its navigation and autoflight systems. The flight did not follow the usual route to Benalla but diverted south along the coast before tracking to the northernmost initial approach waypoint BLAED of the Benalla Runway 26L GPS NPA. While tracking to BLAED the aircraft diverged left of track, without the pilot being aware of the error. The air traffic control Route Adherence Monitoring (RAM) system triggered alerts, but controllers believed the aircraft was tracking to a different waypoint and did not question the pilot about the aircraft's position. The destruction of the aircraft navigation and flight control systems did not permit verification of their operational status. The investigation found that instructions to controllers relating to RAM alerts could be ambiguous. Actions were taken by Airservices Australia to enhance alerts and clarify controllers' responses to them.

The occurrence drew pilots' attention to the need to pay careful attention to the use of automated flight and navigation systems and also demonstrated the need for effective communication between controllers and pilots to clarify any apparent tracking anomalies. The Australian Transport Safety Bureau's (ATSB) final report was released on 7 February 2006.

In July 2008, during the subsequent coronial inquest, additional information about the possibility of dead reckoning navigation by the GPS receiver was provided. The ATSB investigation was reopened to examine that possibility and an amended report issued. That investigation found that dead reckoning navigation could not be positively established as there were inconsistencies between dead reckoning principles and the recorded radar data. Neither could it reconcile how a pilot would continue navigation by GPS with the alerts and warnings provided by the GPS receiver and the instrument indications. As a result of the reopened investigation, the ATSB issued a safety advisory notice alerting users of GPS navigation receivers to take appropriate action to ensure familiarity with dead-reckoning operation and any associated receiver-generated warning messages.

Media release and Audio Grab of Media Conference

Fatal aircraft accident raises ongoing safety issues

A Victorian Coroner recently released findings into a 2004 fatal Piper aircraft crash near Benalla, Victoria.  The findings highlight a number of safety concerns that require review by the aviation industry in relation to the safety issues raised by the ATSB in its reports released on 7 February 2006 and 2 March 2009.

These issues cover:

• communications between pilots and air traffic control
• terrain awareness warning systems
• awareness of GPS in dead reckoning mode and the use of automated flight systems.

Circumstances of the accident

On 28 July 2004, a Piper PA31T Cheyenne crashed with six people on board, travelling from Bankstown to Benalla.  Prior to the accident the pilot reported commencing a Global Positioning System (GPS) non-precision approach (NPA) to Benalla in instrument meteorological conditions.

The flight did not follow the usual route to Benalla, but diverted south along the coast before tracking to the northernmost initial approach waypoint BLAED of the Benalla Runway 26L GPS NPA.  While tracking to BLAED the aircraft diverged left of track, without the pilot being aware of the error.  The air traffic control Route Adherence Monitoring (RAM) system triggered alerts, but controllers believed the aircraft was tracking to a different waypoint and did not question the pilot about the aircraft's position.  The pilot commenced the landing at an incorrect location.

The destruction of the aircraft navigation and flight control systems did not permit verification of their operational status.

Safety Issues

The ATSB found the following safety issues as part of the investigation:

1. Communication between Pilots and Air Traffic Controllers

The Investigation found that instructions to controllers relating to RAM alerts could be ambiguous.  Actions were taken by Airservices Australia to enhance alerts and clarify controllers' responses to them.  The occurrence demonstrated the need for effective communication between controllers and pilots to clarify any tracking anomalies.

2. Terrain Awareness Warning Systems

The ATSB made a recommendation to CASA to review the requirements for Terrain Awareness Warning Systems (TAWS) for Australian registered turbine-powered aircraft below 5,700kg with the aim of reducing the potential for Controlled Flight into Terrain accidents.

In a recent notice of proposed rule making for Part 135 of the Civil Aviation Safety Regulations 1998, CASA included a proposed regulation that would require aircraft carrying six or more passengers, operating in instrument conditions, to be equipped with a TAWS.  This would address they type of operation in which the accident aircraft was engaged.

3. GPS in DR Mode

The ATSB and the Coroner differed in their views as to whether or not the GPS may have been in Dead Reckoning (DR) mode without the pilot being aware.[1] The ATSB considered there was an absence of technical and factual evidence to allow a positive finding to be made but acknowledged the possibility.  Further, the ATSB proposed that a fault within the aircraft's navigation or autoflight systems, mis-selection of those systems, or some combination of those factors may have contributed to the accident.

Despite not making a positive finding with respect to the GPS being in DR mode, the ATSB noted that users of satellite navigation receivers have very little explanatory information about in-flight dead reckoning navigation.  They may not appreciate that in-flight dead-reckoning navigation can provide navigation guidance along preselected routes, including the tracks of the instrument approach, without any user interaction.

The ATSB issued Safety Advisory Notice AO-2008-050-SAN-008 advising users of GPS navigation receivers to note the safety issue and take appropriate action to ensure familiarity with dead-reckoning operation and any associated receiver-generated warning messages.

The occurrence also draws the attention of pilots to the need to pay careful attention to the use of automated flight and navigation systems.

The Coroner reinforced the need for pilots to be aware of this safety issue.

ATSB Investigations and Coronial Inquiries

Inquests are separate to ATSB investigations.  There are differences in the ATSB's and the Coroner's conclusions with respect to this accident.  However, as outlined above, the respective authorities largely agree on what the safety issues are that the industry needs to take account of.

The ATSB's report can be downloaded by clicking on the link: AO-2008-050.  Feedback can be provided via the website.

The Coroner's report can be downloaded by clicking on the link: Coroner's Report.  Queries regarding the Coroner's findings should be directed to the Coroner's Court of Victoria.