After the Boeing 747-400 aircraft, registered N109UA, landed on runway 27 at Melbourne Airport, the crew vacated the runway via taxiway M at the western threshold. They then entered taxiway E, parallel to runway 27. The crew reported that while taxiing eastward along taxiway E, the aircraft veered left of the taxiway centreline. The co-pilot, who was handling the aircraft, applied right tiller and pedal to correct the veer. When the aircraft began to move right of the centreline, the captain took control because he felt that the co-pilot's correction was not arresting the divergence. The captain applied a left correction and reported that he felt that the aircraft was not responding. When he applied additional left control input, the aircraft responded rapidly, and he was unable to stop the aircraft oversteering the centreline. The aircraft failed to respond to the captain's corrective actions, and he applied brakes. However, he was unable to stop the aircraft before the nose wheel and the left wing and body gear left the taxiway and became partially bogged in the grassed area beside the taxiway.

The operator reported that a post maintenance inspection of the nosewheel steering system found low cable tensions on the nose gear steering cables. Subsequent removal of the hydraulic nosewheel steering metering valve and laboratory examination by the component manufacturer found some anomalies but the valve was capable of normal steering operation. Although the low tension of the steering cables was considered a possible factor in the development of the occurrence, the reason for the loss of steering control was not positively determined.

Local Safety Action

The freight carrier has indicated that they have reissued national instructions to staff reiterating that loading is not to commence until loading supervisors and pallet loader operators are in receipt of loading instructions for the aircraft. It has also reiterated to managers that they should ensure that the pallet loader operator is required to check the container numbers and positions prior to commencing loading operations in accordance with the freight carrier's documented standard operating procedures.

The freight carrier has also issued standard operating procedures requiring loading staff to provide flight crew with a copy of the loading documentation which identifies the containers and their location on the aircraft.

The aircraft operator has indicated that it has produced a load-training program for the particular aircraft type. They are planning to have all the freight carrier's staff responsible for the loading of the HS-748 aircraft undergo this training.

The pilot of a de Havilland Beaver floatplane, registered VH-AQV, was conducting a charter positioning flight from Hamilton Island Marina to Whitehaven Beach, Whitsunday Island. At approximately 1615 Eastern Standard Time (EST), the pilot was landing the aircraft towards the south, about 600 m off the beach, to avoid mechanical turbulence associated with terrain at the southern end of Whitehaven Beach. He reported that the approach and flare were normal, however, as the aircraft touched down on the right float, the aircraft swung sharply right and then sharply left. The left wing contacted the water, and the aircraft overturned. The pilot exited the upturned aircraft through the left rear passenger door and activated a 121.5 MHz distress beacon.

The Hamilton Island terminal area forecast (TAF) issued at 0426 EST indicated that the wind was expected to be from 140 degrees at 20 kts. An amended TAF issued at 1043 EST indicated that wind gusts up to 28 kts were expected. The Hamilton Island automatic weather station recorded the wind conditions at 1600 EST as 130 degrees at 26 kts, gusting to 30 kts. The pilot reported that the visibility and general weather conditions were good. There was a slight crosswind from the right and light to moderate turbulence during the approach and landing. He described the sea state as a light swell with significant chop.

The accident flight was the pilot's last of 6 flights into Whitehaven Beach that day. He reported that conditions had remained much the same throughout the day. Another company aircraft had taken off from Whitehaven Beach about 5 minutes before the accident.

The pilot had accrued a total of 486 hours in floatplane aircraft and approximately 1500 water landings, almost all of which were conducted onto still water. He had been with the company for about 1 month at the time of the accident, and had accrued a total of about 50 hours on the Beaver aircraft, almost all on the accident aircraft.

The aircraft was fitted with floats that were larger than standard, in accordance with a supplemental type certificate. The floats extended further forward than standard floats, and the aircraft's centre of gravity was generally close to the forward limit at light weights. The aircraft manufacturer advised that the aircraft "would require a much greater nose-up pitch attitude" on landing than a Beaver aircraft equipped with standard floats.

The pilot cancelled SARWATCH prior to landing as there was no Very High Frequency (VHF) radio coverage once the aircraft was on the water. After the aircraft had overturned, the pilot had no means of communication, other than the distress beacon. The passengers waiting on the beach had no means of communication with either the pilot or the company. When the company did not receive a departure radio report from the pilot, another company aircraft diverted to the area and located the overturned aircraft. The pilot was rescued from the aircraft by a company helicopter approximately 2 hours after the accident.

At 1637 EST, Australian Search and Rescue (AusSAR) identified an extremely poor quality distress beacon signal located 94 km south of Mackay (194 km south of Whitehaven Beach). The detected signal was of poor quality, most likely because of the position of the satellite relative to the beacon. Another satellite in a better position acquired a signal at 1753 EST, which was determined to originate from a position 31 km northwest of Mackay (74 km south of Whitehaven Beach). AusSAR reported that they did not have a high level of confidence in the location identified, because contact with the beacon signal was only maintained for approximately 100 seconds. AusSAR dispatched a search helicopter from Mackay however the helicopter was not able to detect the signal. AusSAR was not able to conclusively establish that the two distress beacon signals identified in the Mackay area were associated with the activated beacon at Whitehaven Beach.

The wind strength and sea state at the time of the occurrence were not ideal for floatplane operations, particularly given the pilot's relative lack of experience in open water operations. In comparison, it was unlikely the non-standard floats contributed significantly to the development of the accident. The loss of directional control suggests a lower than ideal pitch attitude at touchdown, a configuration which reduces a floatplane's directional stability. The pilot's use of a distress beacon for search and rescue purposes was appropriate, however the timeliness of his rescue from the upturned aircraft can be attributed to the effectiveness of the company's flight monitoring system and subsequent search and rescue actions.

AusSAR further advised the following in relation to distress beacon detection:

"The successful detection of a 121.5 MHz distress beacon by the Cospas-Sarsat system is dependant on a number of factors involving the beacon, the satellite, satellite pass geometry and the receiving station (LUT). These factors include:

"a. the beacon performing in accordance with Australian/NZ standards, particularly the beacon signal meeting approved specifications;

"b. the beacon being deployed correctly i.e. line of sight to the satellite is not obstructed, aerial is fully extended, battery fully charged;

"c. the beacon operating long enough to reach normal operating temperature, allowing the frequency to stabilise, before detection (approx 10 mins);

"d. the satellite and LUT performing in accordance with Cospas-Sarsat specifications;

"e. the satellite having an unencumbered view of the beacon and the LUT;

"f. the LUT receiving a minimum of four minutes of data, which includes the time the satellite was closest to the beacon;

"g. other strong transmissions in the bandwidth may mask the beacon transmission; and

"h. a second satellite pass will be necessary to resolve the ambiguity between the two positions calculated.

"Beacons operating outside the specifications may cause the beacon not to be detected. Moreover, positional accuracy may be affected or side bands may generate multiple detections, masking the real beacon. Nevertheless, even if all the specifications relating to the beacon, satellite and LUT are not met, the system is designed so that 70% or more of the nominal solutions are accurate to within 20 km of the real beacon position, and 95% are accurate to within 40 km of the real beacon position. The operational consequence of these accuracies is that further search activity, typically homing by an aircraft, is required to ascertain the precise position of the distress beacon and the nature of the distress. This may take a number of hours, or might even need to wait until light and weather are suitable for aircraft operations. Pilots need to take account of these timescales when deciding what survival equipment to carry."

AusSAR also advised that the current 121.5 MHz distress beacons will become obsolete in February 2009 when the Cospas-Sarsat satellite system will no longer process the signals. From that time, only 406 MHz distress beacons will be detectable. A 406 MHz beacon is more effective than a 121.5 MHz beacon under most circumstances, because it allows near instantaneous detection by a geostationary satellite, the digital signal includes a unique identification code, the signal is more powerful, and beacon detection is more accurate. Some 406 MHz beacons incorporate GPS position (either integral or external feed) which further enhances AusSAR's ability to accurately locate the beacon. The 406 MHz beacon also requires correct deployment and functioning for optimum performance.

Further information on operation of distress beacons can be found in the Emergency Procedures section of En-Route Supplement Australia (ERSA) or from the AusSAR website.

CASA subsequently issued Airworthiness Directive AD/R44/18 - Main Rotor Blades (Robinson R44 Series Helicopters) effective 3 March 2003. That AD directed operators of Robinson R44 Series helicopters to visually inspect and test main rotor blades' upper and lower skin-to-spar seams for evidence of disbonding of the laminate structure. Any blades that showed evidence of disbonding were to be removed from service. The AD requires the carriage of the AD on board the helicopter and the inspections in accordance with the AD `immediately before further flight' from 3 March 2003 `and thereafter at each daily inspection'.

Operator

Following this incident, the aircraft operator standardised approach procedures across all aircraft types in their mainline fleet.

Recommendation

The aircraft's deviation from the runway centreline during the final stages of the flight was undetected and uncorrected by the pilot. This could indicate that the visual cues available during the final stages of flight were insufficient for the pilot to safely land the aircraft. Significantly, the pilot did not recognise that those visual cues had diminished to such a point where he was unable to control the lateral position of the aircraft over the landing runway.

Accordingly, the Australian Transport Safety Bureau makes the following recommendation.

Recommendation R20040090: Department of Defence

The Australian Transport Safety Bureau recommends that the Department of Defence (airport infrastructure owner) and Darwin International Airport Pty Ltd (civilian facilities operator) consider installation of centreline lighting and touchdown zone lighting, consistent with CASA recommended practices on runways wider than 50 m.

This occurrence was not the subject of an on-site investigation by the ATSB.

The Dromader aircraft was engaged in fire bombing operations in rugged terrain. Retardant carried in the Dromader's hopper was to be dropped on a fire, burning about half way up the eastern slope of a steep valley, oriented northwest to southeast. Before releasing the retardant, the pilot made a dummy run from the southeast to the northwest at a height of about 50 ft above the tree canopy. He then manoeuvred the aircraft onto a reciprocal heading for the drop run. Although that was in the direction of the head of the valley, the pilot's intention was to turn west into the valley after releasing the retardant.

The pilot reported that after releasing the retardant he applied full power and attempted to climb and turn, but found that the aircraft performance was less than that expected. He reported that when he attempted to bank the aircraft away from the side of the valley, the aircraft's performance diminished, depriving him of manoeuvrability. The pilot believed that he had encountered adverse windshear conditions in the lee of the ridge, associated with an active thunderstorm to the east of the ridge. Unable to turn away from terrain, the pilot maintained control of the aircraft but was flying toward the head of the valley. When he saw that a collision with trees was inevitable he transmitted on the dedicated communication frequency `I'm going in' and slowed the aircraft, allowing it to settle into the tree canopy. The aircraft collided with the foliage, pitched nose down and dropped to the ground in a near vertical attitude.

After ground impact, a fire started in the engine compartment and the pilot quickly egressed from the burning wreckage. The aircraft was destroyed by impact forces and the post impact fire. The plot reported that he had not detected any abnormality with the aircraft immediately prior to the accident.

Witnesses on the ground reported the presence of a thunderstorm on the other side of the ridge and occasional strong gusts of wind from the northeast. One witness reported seeing the aircraft wings roll to a "knife-edge" (90 degrees) attitude, then return to level just before the aircraft struck the tree canopy. The crew of an observation aircraft operating overhead the fire bombing activity, heard the pilot's transmission and watched as the Dromader impacted heavily timbered terrain below the top of the ridge. They also reported the presence of the nearby thunderstorm, northeast of the area. The crew of the observation aircraft reported that they did not encounter any significant turbulence or windshear at their altitude, about 1,500 ft above the Dromader.

The ATSB was unable to determine the exact circumstances of the accident. It was possible that the outflow of air from the thunderstorm, spilled over the ridge, creating down draughts that were in excess of the aircraft's climb performance, depriving the pilot of the manoeuvrability necessary for executing the intended flight path.

On 17 December 2003, after consultation with, and agreement from, the airframe manufacturer, the engine manufacturer promulgated Service Bulletins TPE331-A73-0266 and 0267 recommending maintenance action affecting the Viscojet, and a functional test able to detect early blockage of the Viscojet.

The operator has addressed the risk of Viscojet blockage resulting from its operations in the northern WA environment by increasing the frequency at which it cleans the P-3 air filter elements to every 50-flight hours.

In addition, the operator has reviewed its engine shut down procedures in the case of an Uncommanded Power Increase during Takeoff in Conquest aircraft. While the airframe manufacturer indicated reluctance to amend the published procedure to include movement of the condition levers into the SHUT-OFF detent, indication was given that, if time and circumstances permitted, emergency action could be used as a back-up to the existing priority of activating the STOP button.

After consideration, the operator has amended its emergency procedures to include movement of the condition levers into the SHUT-OFF detent. The Civil Aviation Safety Authority has accepted that amendment.

¹ The PIC reported that the take-off was commenced with the fuel computer guards raised, in accordance with published temporary revisions to the Pilot's Operating Handbook. He also reported that in an attempt to de-select the fuel computers he lowered the fuel computer guards.
² The runway strip is defined as that portion of ground between the runway and the fly-over area which is in a condition that ensures minimal damage to an aeroplane which may run off a runway during a take-off or landing.
³ Engine manufacturer advice was that the action to activate the stop button prior to retarding the power levers was because an action to initially select the emergency shutdown position would result in a momentary power surge from the affected engine. There was the potential for that power surge to add to any control difficulty experienced by the pilot.

On 31 January 2003, at 0621 UTC (1521 local time), an Ilyushin 76TD (IL-76TD) aircraft, registered RDPL-34141, impacted terrain near Caicido village during a landing approach, about 1 NM (1.87 km) to the northwest of Cakung Airport, Baucau, Timor-Leste. The pilot in command was the handling pilot during the descent and approaches at Baucau. The aircraft was destroyed by impact forces and a severe post-impact fire, and the six occupants were fatally injured. The occupants included the flight crew, which comprised the pilot in command, the copilot, the flight navigator and the flight engineer, and two loadmasters who did not form part of the flight crew.

At the time of the occurrence, there was low cloud near the aerodrome. Witnesses at the aerodrome estimated the cloud base to be about 1,000 ft (305 m) above ground level, and visibility to be about 1,500 m (0.8 NM).

Before the aircraft's departure from Macau, the flight crew was provided with notices to airmen (NOTAMs) and weather forecast information for the planned flight. The weather information provided to the flight crew did not include a terminal aerodrome forecast (TAF), or an aviation routine weather report (METAR) for Baucau. Those weather forecasts were not produced for Baucau.

The investigation determined that the flight crew's compliance with procedures was not at a level to ensure the safe operation of the aircraft. Before the flight crew commenced the descent into Baucau, the pilot in command briefed them that he would conduct a non-precision instrument approach at Baucau, with reference to the Baucau non-directional beacon (NDB). The flight instruments fitted in the occurrence aircraft provided readings of height, speed and distance in metric units. The pilot in command's briefing included information on the relevant heights for the missed approach procedure expressed in feet, and not in their metric equivalents. None of the other crewmembers commented on that fact. The cockpit voice recorder (CVR) data revealed that the pilot in command did not refer to the source of data that he used for the briefing on the intended NDB approach at Baucau. The pilot in command's arrival briefing also contained no information or discussion on:

• the planned altimeter subscale settings for the descent to Baucau
• the applicable minimum sector altitude (MSA) within 10 NM (18 km) of the Baucau NDB; the MSA was 9,300 ft (2,834 m) above mean sea level (AMSL)
• the commencement altitude for the runway 14 NDB approach at Baucau, which was 5,500 ft (1,676 m) AMSL
• the lowest safe altitude (LSALT) for the last route sector into Baucau, which was 4,500 ft(1,372 m) AMSL
• the applicable minimum descent altitude (height) (MDA(H)) for the approach
• the expected weather at Baucau
• the Baucau NOTAMs.

The CVR data revealed that none of the other crewmembers commented on the omission of this critical information. As a result, the arrival briefing was not effective.

Controlled airspace was established at Baucau, but air traffic services (ATS) at Baucau was only available for UN aircraft on UN troop rotation days. The NOTAMs for Baucau included that information. The occurrence aircraft was not engaged in UN troop rotation operations, and no troop rotations took place during the aircraft's approach to Baucau.

When the aircraft was about 300 km from Baucau, the pilot in command instructed the copilot to call Baucau ATS. Over the next 23 minutes, the copilot called Baucau Tower 25 times, but received no response to those calls. The flight navigator then called Baucau Tower. A controller, who was present at Baucau aerodrome at the time, but not on operational duty, advised the flight crew that ATS was not available and that landing would be at the discretion of the flight crew. The flight navigator acknowledged the controller's advice, but did not seek information from the controller about the prevailing weather at the aerodrome. That was a missed opportunity for the flight crew to obtain updated information on the weather at Baucau. Had the flight crew sought and received that information, it may have provided them with an improved situational awareness of the prevailing weather.

During the descent in Timor-Leste airspace, none of the flight crew monitored the Timor Common High frequency of 123.45 MHz while the aircraft was above 10,000 ft (3,048 m). They also did not monitor the Timor Common Low frequency of 127.1 MHz while the aircraft was below 10,000 ft, or broadcast their intentions and traffic information on that frequency. Therefore, the flight crew had no assurance that there was no conflicting traffic. The flight crew's disregard of the requirement for traffic information broadcasts within Timor-Leste airspace increased the potential risk of an inflight collision.

The pilot in command diverted the aircraft from the published inbound track to the Baucau NDB, and descended the aircraft below the published 10 NM MSA. He continued descending the aircraft through the commencement altitude for the published non-precision instrument approach for runway 14, and through the LSALT. None of the other crewmembers commented that the pilot in command had breached those relevant safety heights.

The Baucau NOTAMs included information that instrument approach charts for Baucau were available from the Civil Aviation Division (CAD) of the Ministry of Transport, Communication and Public Works, Timor-Leste. However, the investigation determined that the flight crew used Jeppesen instrument and approach charts, and not the CAD-issued charts.

As the aircraft approached Baucau, the flight crew decided to conduct an overflight of the aerodrome before making a landing approach, and during the overflight, the flight crew realised that the runway was not where they expected it to be.

The investigation determined that the flight crew did not conduct the overflight of the aerodrome, or either of the landing approaches, with reference to the Baucau NDB. The flightcrew used selected data from their instrument approach charts for Baucau to formulate a user-defined non-precision approach using the onboard global positioning system (GPS). That user-defined procedure was a non-approved procedure. It deviated from normal practice, bypassed all the safety criteria and risk treatments inbuilt into the design of the published non-precision approach procedures, and increased the risk of a controlled flight into terrain (CFIT) accident.

The flight navigator provided the pilot in command with distance to run and lateral offset distance from the runway centreline during the overflight and the first landing approach. The flight navigator's reference to distance and lateral offset during those manoeuvres corresponded to the position of the aircraft in relation to the threshold of runway 14 as depicted on the Jeppesen charts. The navigation data provided by the flight navigator was therefore accurate in terms of where he expected the threshold of runway 14 to be, based on the Jeppesen charts. However, erroneous data on the Jeppesen charts meant that it was inaccurate in terms of where the threshold of runway 14 was actually located. The flight crew's inappropriate reliance on that data therefore increased the risk of a CFIT event.

Had the flight crew followed the non-precision runway 14 NDB approach procedure as published on either the CAD or Jeppesen charts, and not descended below the relevant MDA(H) until visual flight was assured, the position of the runway, as depicted on the Jeppesen charts would have been irrelevant. Although the runway would not have appeared where the flight crew expected it to be at the MDA(H), in visual meteorological conditions (VMC) a safe approach could have been conducted to the actual threshold of runway 14. Alternatively, if a visual approach could not be made from the relevant MDA(H), a safe missed approach could have been conducted by following the published missed approach procedures.

During the overflight and the subsequent (first) landing approach, the flight crew realised that the runway was not where they expected it to be as it was depicted on the Jeppesen charts. The pilot in command discontinued the landing approach, and the flight navigator stated that he would apply a 4 km correction to position the aircraft for a second landing approach to where he thought the runway was located. By applying the 4 km correction, the flight navigator was providing the pilot in command with inaccurate data, and resulted in the aircraft being repositioned towards a point about 1.65 km (0.88 NM) northwest of the actual position of the threshold of runway 14. That incorrect data substantially increased the hazards of the user-defined approach procedure, and the risk of a CFIT event at that stage of the flight increased to a high degree. The flight crew did not appear to identify the hazards associated with the intended improvised approach procedure, and were therefore not in a position to manage the associated risks.

As the aircraft turned on to the final approach heading during the second landing approach, the flight navigator stated that the aircraft was high on the approach profile, based on his assumption of the location of the threshold of runway 14. The pilot in command increased the rate of descent of the aircraft to about 18 m/sec (3,543 fpm), and stated 'Increased'. None of the other crewmembers commented on the high rate of descent, or drew the pilot in command's attention to the fact that the approach was unstabilised at that point. The risk ofa CFIT event is diminished by a stabilised approach, and the high descent rate in close proximity to terrain at that stage of the flight increased the risk of a CFIT event to the point where impact with terrain was almost certain. The CVR data provided no evidence that the flight crew was monitoring the increasing risk and evaluating whether to discontinue the approach to treat that risk.

The flight engineer misinterpreted the pilot in command's statement 'Increased' to be an instruction for him to increase the engine thrust, and he advanced the thrust levers. It took about 2 seconds for the pilot in command to realise that engine thrust had been increased, and he reacted by calling 'No, I increased vertical speed' and reduced the engine thrust. The flight engineer's action in increasing engine thrust was a significant distraction to the pilot in command at that stage of the flight, and probably diverted his attention from the primary task of flying the aircraft to restoring the thrust to the proper setting.

At about the same time, the aircraft descended through 162 m, which was the published MDH for a straight-in landing on the runway 14 NDB approach. Neither the pilot in command nor the copilot appeared to notice that the aircraft had descended through the MDH, and it is probable that both were distracted by the flight engineer's erroneous action. The risk ofa CFIT event is diminished if an approach is flown no lower than the published MDA(H) of an instrument approach procedure until visual flight can be assured and maintained. At that stage of the flight, descent below the MDH in instrument meteorological conditions (IMC) at a high rate of descent meant that the risk of a CFIT event had increased to an unacceptably high level and could not be treated. Impact with terrain was almost certain from that point onwards.

The high rate of descent continued unchecked until slightly less than 2 seconds before impact. It is probable that the pilot in command and the copilot were each unaware of the high rate of descent, because neither was monitoring the flight instruments while they were looking ahead of the aircraft and trying to establish visual contact with the ground.

The pilot in command applied back elevator to increase the aircraft pitch attitude in response to the copilot's urgent expression of concern that impact with terrain seemed almost certain. However, the pilot in command did not simultaneously increase the engine thrust, and it remained unchanged. Consequently, the pilot in command's attempt to avoid impact with terrain was unsuccessful because of the inertia of the aircraft and its close proximity to terrain.

The aircraft's impact with terrain was a direct consequence of the pilot in command descending the aircraft below the published minimum descent height for the runway 14 non-precision instrument approach procedure in an unstabilised manner. Furthermore, it was also as a result of poor planning by the flight crew and less than effective crew coordination. During that landing approach, the actions of the flight crew steadily increased the risk of a CFIT to an extreme level, yet they seemed unaware that the likelihood of impact with terrain was almost certain until about 2.5 seconds before it occurred.

Research conducted by an aviation industry task force, under the patronage of the International Civil Aviation Organization (ICAO), has credited the main reasons for accidents involving aeroplane hull losses to CFIT and approach-and-landing accidents. In recent years, CFIT-reduction has been the focus of organisations such as ICAO and the Flight Safety Foundation (FSF). The findings of the FSF approach-and-landing accident reduction (ALAR) task force resulted in several conclusions and recommendations, and from those, the production of the FSF ALAR Tool Kit.

This report highlights that deviations from recommended practice are a potential hazard, particularly during the approach and landing phase of flight, and increase the risk of a CFIT event. It also highlights that crew coordination is less than effective if crewmembers do not work together as an integrated team, and that support crewmembers have a duty and responsibility to ensure that the safety of a flight is not compromised by non-compliance with recommended practices.

The potentially serious to catastrophic consequences of a CFIT event remain constant, irrespective of likelihood of the event. The potential risk of CFIT can be diminished by using current technology and equipment, by implementing adequate standard operating procedures, by assessing and managing CFIT risk factors, and by developing effective crew decision-making and risk management processes.

Safety recommendations from many investigations of CFIT events and serious incidents have related to the prevention of CFIT and approach-and-landing accidents. The Australian Transport Safety Bureau (ATSB) and CAD Timor-Leste endorse those recommendations and their implementation.

This report includes a number of recommendations made by the ATSB with the intention ofenhancing the safety of flight within Timor-Leste airspace. The report also includes a recommendation by CAD Timor-Leste that ICAO publicise the safety information contained in this report.

Abstract

On 7 February 2003, a Raytheon (Beech Aircraft Corporation) BE76 Duchess aircraft, registered VH-JWX, was being flown for the purpose of an initial-issue multi-engine command instrument rating flight test. A Civil Aviation Safety Authority (CASA) designated Approved Testing Officer (ATO), who was also the pilot in command of the flight, was to conduct the test. The other pilot was the flight test candidate who was flying in a 'dual' capacity because he was not yet qualified to conduct the flight. The candidate had to demonstrate to the ATO a number of manoeuvres in order to pass the flight test. Some of these manoeuvres included a demonstration of aircraft handling during a simulated engine failure. One manoeuvre required a demonstration of handling the aircraft when an engine failure was simulated during or after a take-off. The candidate reported that he and the ATO had agreed, prior to the flight, that simulated engine failures would not be conducted below a height of 500 ft above ground level (AGL).

The candidate had planned the flight to depart from Bankstown, NSW, and fly via Wollongong and Camden before returning to Bankstown. The planned departure time was 1915 Eastern Summer Time, however the aircraft did not depart Bankstown until 2038, which was 16 minutes after the end of daylight.

During interview, the candidate advised that they had conducted instrument airwork at Wollongong, including procedures with simulated engine failures, before they flew on to Camden.

At 2134, the candidate made two broadcasts on the Camden mandatory broadcast zone (MBZ) frequency, announcing that he was in the circuit area at Camden and intending to conduct an approach to runway 06 for a touch-and-go. Soon after take-off from the touch-and-go, a witness observed the aircraft flying at a low height and parallel to the runway, with the landing gear retracted. Another witness reported hearing two loud impacts. That witness observed that the aircraft had impacted the ground and had caught fire, beyond the departure end of the runway and to the right of the runway 06 extended centreline. The candidate and the ATO received severe burns as they evacuated the aircraft. The ATO died during the following morning.

The candidate stated during interview that, shortly after take-off from the touch-and-go, as he was handling the landing gear retraction switch, the ATO simulated a failure of the right engine. The candidate said that he continued to retract the landing gear and manoeuvred the aircraft to maximise its climb performance, but did not handle the engine controls. He reported that because the aircraft was not achieving satisfactory performance, he called for the ATO to apply full power. He said that soon after this call, there was a loud impact noise. Moments later, the aircraft collided with the ground.

An examination of the accident site revealed that the aircraft's right wing had contacted a large tree approximately 296 m beyond, and 133 m right of, the runway 06 extended centreline. The aircraft had climbed approximately 50 ft from where the witness saw the aircraft flying parallel to the runway to the point where the aircraft collided with the tree. The aircraft then appeared to have descended slightly into rising terrain, before it collided with the ground approximately 210 m beyond the tree. Score marks on the ground from the propellers and flaps indicated that the aircraft had impacted the ground at a high angle of attack, with both engines operating at a high power setting, and at a groundspeed of about 55 kts. The aircraft collided with steel and concrete structures as it slowed to a stop, however the cockpit area remained intact. Both wing fuel tanks were ruptured during the impact sequence and an intense post-impact fire erupted, consuming the cockpit area and right engine nacelle.

The weather was reported as being fine, with a light north-east wind and overcast cloud at 5,000 ft. Some illumination was provided by ground lighting from Sydney that was reflected from the base of the cloud.

The candidate reported that the aircraft had been operating normally throughout the flight. A post-accident review of medical history indicated that there were no physiological or psychological factors for either crewmember that may have affected the flight crew's performance prior to, or during the accident.

Aircraft performance

The Duchess was required under Civil Aviation Order 20.7.4 (8) to have a climb capability under defined conditions in the event of an engine failure¹. Typically, a light twin such as the Duchess loses much of its ability to climb with one engine inoperative, with the aircraft configured with the propeller of the inoperative engine feathered and the landing gear retracted. An aircraft's windmilling² propeller creates significantly more drag than a feathered propeller and, as a consequence, the Duchess would not have had the capability to accelerate or climb on one engine, with a windmilling propeller.

Night asymmetric flight

Asymmetric flight at night was not precluded by regulation. However, guidance provided to pilots contained in the Aeronautical Information Publication (AIP) stated that simulated asymmetric flight at night must not be conducted below 1,500 ft AGL. Civil Aviation Advisory Publication (CAAP) 5.23-1 (0) provided guidance on a syllabus of training, which included night asymmetric circuits. A note in that publication reminded the reader that the condition in AIP, which effectively precluded these operations from the circuit area at night, applied. However, no guidance was given on how to reconcile the conduct of asymmetric night circuit operations with the height limitation in AIP.

Previous accident review

A night asymmetric training accident involving a SA227-AC Metroliner, VH-NEJ, at Tamworth on 16 September 1995 (Occurrence report BO/199503057), was investigated by the then Bureau of Air Safety Investigation (BASI), which issued the following interim recommendation on 01 May 1996:

'IR 950224

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority amend the Civil Aviation Regulations and the Civil Aviation Orders to ensure that when a provision of the Aeronautical Information Publication specifically prohibits certain manoeuvres and procedures, then this prohibition has legal force which is reflected in relevant Civil Aviation Regulations and Civil Aviation Orders.

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority take appropriate steps to inform and educate the industry on the hazards involved in asymmetric training operations in conditions of low visibility and at night.'

The Civil Aviation Safety Authority responded to the recommendation 01 August 1996, stating:

'I refer to your interim recommendation IR950224 concerning the accident involving SA227 AC, VH NEJ at Tamworth on 16 September 1995. I apologise for the delay in forwarding the following comments.

The Regulatory Structure and Validation Project (RSVP), which is the first stage of a two-stage review of existing civil aviation regulations, is currently being finalised by CASA. The RSVP will, inter alia, rectify the problems identified in the first paragraph of the BASI recommendation. In addition, CASA endorses the recommendation in the second paragraph of IR950224 and will produce an article in the summer issue of the Flight Safety Australia magazine on the hazards of asymmetric training operations in conditions of low visibility and at night.'

Following the response from CASA, BASI classified the recommendation as 'Closed - Accepted'.

An article appeared in the March/April 2002 edition of Flight Safety Australia entitled 'Even Worse than the Real Thing'. Mention was made of performing the EFATO manoeuvre in visual flight conditions, but it did not emphasise the hazards of conducting 'engine failure after take-off' (EFATO) manoeuvres at night or night asymmetric training.

To date, the issue identified in the first paragraph of the Bureau's 1996 recommendation has not been rectified. Accordingly, the ATSB has amended the status of the recommendation to 'Monitor' pending evidence of the proposed action being taken by CASA.

Role and function of an Approved Testing Officer

The candidate was being tested for a flight qualification that is awarded and administered by CASA. CASA delegated the conduct of most flight tests to Approved Testing Officers (ATOs), who are authorised to conduct flight tests on behalf of CASA.

A flight test is used to demonstrate a pilot's competence in a particular aviation operating environment, to a defined level. Normally, a pilot is not qualified to conduct that type of flight until the flight test has been passed. The test officer is the competent pilot for the flight and is responsible for maintaining the safety of the flight.

A flight test explores the limits of the operating environment that is being examined, even though the limits of that environment will not normally be used while exercising the privileges of the qualification. For example, it is not normal to conduct asymmetric multi-engine operations, except during training, during a flight test, or in the event of an actual engine failure.

Categorisation of flight test operations

There are many similarities between flight training and flight test operations. In both cases:

• the pilot in command is responsible for the safety for the flight. However, the pilot in command does not normally manipulate the controls for most of the flight, although they are entitled to resume control of the aircraft to maintain the safety of the flight.
• the limits of a defined flight envelope are explored, to ensure that the student or candidate is capable of operating the aircraft safely throughout that defined envelope.
• the pilot in command is normally paid for his or her services.

Irrespective of any legislative or regulatory requirement, the nature of both types of operation, and the risks associated with both types of operation are very similar. If a similar risk level is to be expected from both types of operation, it would be reasonable to expect similar defences against those risks to exist in both types of operation.

Unlike formal flight training, flight tests conducted by ATOs were not prescribed as commercial operations. Civil Aviation Regulations (CAR) did not define flight tests as private operations, however they generally referred to private operations as operations in which the operating crew received no remuneration for the flight. In accordance with standard practice, the candidate and the ATO had made a commercial arrangement in that the candidate was to pay the ATO a fee for his flight test services.

A commercial flight operation, as defined under Civil Aviation Regulations³, had to be conducted under the management of a commercial air operator whose activities had to be managed, and the management process had to be approved and monitored by CASA.

Commercial operators who are required, under CAR (1988) 217, to conduct training and checking also conduct similar types of flight test. Those organisations are required to conduct this type of flight test in accordance with the requirements of an Air Operator's Certificate and the Check and Training procedures appended to that Air Operator's Certificate. This provides the opportunity for CASA to authorise the testing process and to ensure that procedures for risk mitigators, such as minimum operating altitudes, are formally maintained. There were no such requirements for flight tests conducted as private flights.

CASA provided guidance to ATOs on the conduct of flight tests in the form of a 'Flight Crew Licensing Industry Delegate's Handbook'. This document described the procedures surrounding a flight test and defined what was to be tested. The handbook did not provide guidance on the conduct or management of a flight test, or the precautions necessary to ensure the safety of a flight test.

Analysis

The ATO commenced a simulated engine-failure exercise from a position where a subsequent safe flightpath could not be assured. The aircraft deviated from the extended runway centreline track and collided with a tree. The ATO and candidate were not able to ensure that the likely flightpath was free from obstacles, so the safety of the flight could not be assured following a simulated engine-failure from this position in the flight. The aircraft's flightpath and normal operating procedures for a simulated engine-failure exercise make it likely that an engine failure was simulated, and then full power was returned to that engine without that propeller being feathered, or any other power adjustments being made.

A flight test is used to examine a pilot's competence throughout a flight envelope that is defined by the requirements for the flight test. A flight test will therefore normally operate nearer the edges of its defined flight envelope than other types of flight. The test officer is the competent pilot on board, and is therefore responsible for the safe operation of the aircraft. The safety buffer inherent from operating within a defined flight environment does not exist when a flight operates outside that environment. That was no different from the flight training regime where an instructor and student are performing the same manoeuvre.

The candidate pilot, who had not yet been deemed competent to fly in the defined flight envelope for the flight test, would normally be the handling pilot. The test officer would therefore be responsible for the safety of a flight being flown by a pilot who might not be competent, while operating at the edge of the defined safe envelope. These conditions remove some of the inherent defences that would make a normal flight safer. This higher risk situation is necessary for the effective conduct of a flight test. In the case of a multi-engine command instrument rating flight test, any abnormal operation of the aircraft, such as asymmetric flight therefore has an element of risk not present in normal operations. Setting safe speed margins and imposing altitude restrictions for the conduct of simulated emergency manoeuvres can mitigate that risk. Using experienced pilots as Approved Test Officers may also mitigate that risk.

Asymmetric flight with one engine failed degrades this aircraft type's ability to climb to a negligible quantity under optimal conditions. It is also normal to expect a minor change in direction as a change to an asymmetric condition is managed. This change in the aircraft's flightpath from two-engine flight to asymmetric flight should be taken into consideration when planning and managing asymmetric flight.

Planned low-level asymmetric flight at night is considered to be an unacceptable risk because, unlike daylight conditions, the pilot may neither know about, nor be able to see, any obstacles in the aircraft's changed flight path in order to take avoiding action.

The flight was a commercial operation, in that the ATO was entitled to charge for his services for the flight test, in the same way that a student pays for the services of a flight instructor when being trained. Because the operation was conducted as a private flight, it did not have similar risk mitigators that are inherent in the required organisational structure for a commercial flight, as happens with flight tests conducted through a Civil Aviation Regulations (1988), Regulation 217 (CAR 217) approved organisation. The ATO was conducting a flight test in accordance with the test requirements set by the CASA, and while acting as a delegate of the authority. CASA provided neither guidance nor prescriptive requirements to ATOs to ensure the consistent, safe conduct of flight tests.

Safety margins for the conduct of multi-engine instrument renewal flight tests are prescribed in the approved training manuals of training and checking organisations. However, when such a flight test is performed outside the oversight of a CAR 217 training and checking organisation, the safety margins can only be determined by the testing pilot and may vary depending on the experience and competency of both the testing pilot and the candidate. This means that the safety standards for the conduct of these flight tests are not consistent across Australian civil aviation.

This was the ATO's first flight with the candidate. Although some asymmetric flying was reported to have been performed earlier in the flight, it was possible that the ATO had determined that the candidate was capable of handling a simulated engine failure just after take-off from runway 06 at Camden. The simulated engine failure was contrary to the preflight briefing and may have been initiated at that point to negate the candidate's anticipation of a predetermined simulated engine failure at the briefed altitude.

The maximum groundspeed at impact was determined to be about 55 kts. In the light wind conditions at the time, the airspeed would have been approximately 60 kts, slightly above the aircraft's stalling speed in that configuration. It is unlikely that the aircraft would have been able to climb or accelerate significantly with only one engine operating while the landing gear was still retracting and the right propeller was windmilling.

The ATO was responsible for the safety of the flight. That responsibility included ensuring that the speed and altitude at which simulated emergency procedures were initiated provided adequate safety margins for the manoeuvres being attempted. The simulated engine failure just after take-off did not provide those adequate margins, especially at night, with inadequate visual reference to ensure obstacle clearance. It was likely that the ATO may not have been aware that the aircraft was not climbing and had drifted well right of the runway toward obstacles and higher ground. Although he reapplied full power to the simulated 'failed' engine at either the candidate's expressed concern or out of his own concern, the response was not timely enough to avoid a collision with the tree or the ground.

The risks associated with low level asymmetric operations at night were identified and addressed in May 1996 in Interim Recommendation IR19950224. Regulatory and education action that was addressed by CASA in its response to the recommendation in August 1996 has yet to be fully implemented.

Significant Factors

A simulated engine failure was initiated from a point where a safe outcome could not be assured.

Safety Action

CASA safety action

CASA is involved in a regulatory reform programme and is leading the development of new regulations which are proposed to be made by government. Some of those proposed regulations, as detailed below, impose new requirements on persons conducting flight tests.

The proposed new Civil Aviation Safety Regulations 1998, Part 91.305, is expected to incorporate a requirement that no planned asymmetric operations are initiated below the circuit height or 1,000 ft above the ground at night, or below a minimum en-route altitude or instrument initial approach altitude in instrument meteorological conditions.

The proposed new Civil Aviation Safety Regulations 1998, Part 61.220, is expected to change the conditions under which flight tests may be carried out. The present draft will require flight tests conducted by 'flight examiners' (those who conduct flight tests) to be booked through a flying training organisation, and that flight examiners must comply with the manual of standards (MOS) associated with Part 61. This MOS will specify what is to be assessed in each type of flight test, and will also specify that other things are not to be tested during the flight test.

The proposed new Civil Aviation Safety Regulations 1998, Part 141, is expected to require the operator to specify through their operations manual the procedures for the conduct of flight tests, and the responsibilities of the flight examiner for the safety of operations during the flight test. These procedures in the operations manual are expected to include the operator's specific requirements and methods for simulating emergencies and the evolutions necessary for the conduct of specific flight tests. Operators will need to be able to demonstrate to CASA that they are operating in compliance with their operating manual.

1 In order to operate under Instrument Flight Rules (IFR), this aircraft type was required to have demonstrated that it could climb at a 1% gradient with its critical engine inoperative, at an altitude of 5,000 ft in an International Standard Atmosphere (ISA). This equated to an indicated altitude of 5,000 ft on an altimeter with a subscale setting of 1013.25 hPa, and an atmospheric temperature of +5C.
2 'Windmilling' is the term used to describe a rotating propeller being driven by the airflow rather than by engine power.
3 Civil Aviation Regulations 1988, regulation 206 defined categories of commercial flight operations.

Related Documents: | Media Release |

On 1 January 2003, the crew of a Boeing 767, registered VH-OGB, operating a scheduled flight from Darwin to Singapore, reported that approximately one hour and ten minutes into the flight, and while maintaining FL380, they received an Engine Indicating and Crew Alerting System (EICAS) message indicating an autopilot and autothrottle disconnect. They reported that their attempts to re-engage the systems were unsuccessful so they reverted to manual control. Additionally, some navigation and fuel calculation functions of the Flight Management Computers (FMC) were not available. The crew elected to continue the flight and descended the aircraft to FL310 to improve manual control. They rotated cockpit duties to avoid fatigue and made an uneventful landing at Singapore.

The operator reported that an examination of the aircraft systems by engineering staff found that both elements of the dual Total Air Temperature (TAT) probe unit had failed. The TAT probe was mounted on the left side of the lower forward fuselage and consisted of dual sensors to provide system redundancy in the event of failure of one sensor. Each sensor of the TAT probe provided air temperature data to its respective Central Air Data Computer (CADC). When temperature input was lost to both CADCs, the FMC disconnected the autopilots and autothrottles, and was unable to provide some of the navigation and fuel calculation information.

The failed TAT probe was removed and sent to the component manufacturer for a detailed examination. The manufacturer of the TAT probe reported that a visual examination of the failed probe revealed damage from electrical discharge that suggested it may have been subjected to a lightning strike. The operator's records for the aircraft showed that a lightning strike on the lower left fuselage had occurred on 29 August 1999, but an inspection carried out in accordance with the aircraft manufacturer's maintenance manual, that included the TAT probe, had not revealed any evidence of lightning damage to the TAT probe.

Examination of the failed TAT probe by the manufacturer found that a dimple in the inner element tube had `popped' outwards and all four ends of the heater element leads had contacted the inner tube of the unit creating an electrical short. The manufacturer reported that water freezing in the element tube may expand and push the dimple outward. Although the visible evidence of electrical discharge had led them to conclude that failure was most likely due to a lightning strike, the reason could not be positively identified. The three years and four months that elapsed from the time of the initiating event until failure also could not be explained.

On 14 August 1998, the operator reported that a dual element failure to the TAT probe occurred to another B767 of their fleet (ATSB Occurrence number 199702646). The operator expressed concern to the aircraft manufacturer that a single, dual-element TAT probe may represent a single-point failure as both elements could become inoperative following a single event. The aircraft manufacturer advised the operator that 'The TAT probe failure described … is extremely rare on the 767'. The manufacturer considered that the dual element met certification requirements and that following failure of both TAT systems, sufficient information was available to safely continue flight under manual control.

During the investigation the operator reported another dual element failure of the TAT probe to a B767 aircraft on 28 February 2004 (ATSB Occurrence number 200400759). The operator advised that following the third dual element failure of a TAT probe and their subsequent investigations, they were implementing a functionality check of all TAT probes into the scheduled maintenance program of their B767 aircraft, and incorporating the requirements of the manufacturer's Service Letter 767-SL-34-111 dated 31 March 1998. That Service Letter suggested that operators install, at a convenient maintenance opportunity, a replacement TAT probe that offered improved performance under severe icing conditions.

The operator advised the ATSB that accounts and analysis of the Crew Resource Management (CRM) issues of both recent TAT probe failures had been drafted for publication and will be published for the education of other crews. Additionally, the operator advised that they had introduced the scenario into the CRM training discussions.