Forced/precautionary landing

Executive summary

What happened

On 8 March 2024, the pilot of an Aero Commander 500-S, registered VH-MEH and operated by GAM Air, was conducting a return cargo transport operation from Bankstown Airport to Parkes Regional Airport, New South Wales with one intermediate stop outbound, and 2 intermediate stops on return.

After landing on the first sector, the pilot found the fuel cap was off and secured only by a retention chain. The pilot re‑secured the cap but after landing at Parkes on the second sector, they again found the fuel cap off, and arranged an inspection by a maintenance engineer. The engineer found a fault that prevented the fuel cap from locking and rectified it.

Later that day, the pilot commenced the return sectors to Bankstown. Shortly after departing Bathurst for the final sector, both engines lost power, and the pilot conducted a forced landing in a field. The aircraft was undamaged and the pilot was uninjured.

What the ATSB found

The ATSB found that for the first 2 sectors, the fuel cap was incorrectly installed with the retention chain lodged in the fuel tank’s anti-siphon valve, resulting in the cap dislodging in‑flight and fuel being siphoned overboard. At Parkes Regional Airport, the pilot identified an unexplained discrepancy between expected fuel remaining and gauge quantity indication but did not refuel to a known quantity or amend the flight log. As a result, the aircraft departed Parkes with the pilot unaware there was insufficient fuel to complete the remaining flights.

After departing Parkes, the pilot likely did not monitor the fuel gauge, continued fuel calculations based on an incorrect fuel quantity, and did not refuel the aircraft to a known quantity at Bathurst Airport. This resulted in fuel exhaustion shortly after the aircraft departed from Bathurst.

The ATSB also found that GAM Air's Quick Turn Around – Pre-Start checklist did not include a fuel quantity check before start, contrary to the aircraft flight manual’s before-start checklist.

What has been done as a result

GAM Air published a pilot notice reinforcing fuel management procedures for Aero Commander 500 series aircraft. The notice highlighted the importance of fuel tank cap security, and the likelihood of fuel loss should a fuel cap become dislodged, despite the anti-siphon valve. The notice also provided instructions and guidance on fuel planning, in-flight fuel calculations and fuel log entries to expand on information in the standard operating procedures.  

GAM Air also commenced periodic auditing of pilot fuel calculations and advised an intention to discontinue use of the Quick Turn Around – Pre-Start checklist. The fuel supplier at Bankstown was also reminded of the requirement to let fuel settle when refuelling.

Safety message

A missing or unsecured fuel cap can lead to rapid and substantial fuel loss in‑flight, even when the fuel tank is equipped with an anti-siphon valve. Loss of a fuel cap in‑flight should be considered as an emergency and, if detected, an immediate diversion to the nearest suitable aerodrome should be conducted. In addition, in aircraft with rubber fuel cells or bladders, fuel gauge readings should not be relied upon as siphoning of fuel can lead to collapse and distortion of the cells causing the fuel gauge to overread. Filling to an amount that can be visually confirmed is required to re‑establish an accurate measure of fuel on board.

The Civil Aviation Safety Authority’s Advisory Circular 91-15 – Guidelines for aircraft fuel requirements, stated:  

It is of critical importance that the amount of usable fuel on board an aircraft at the commencement of and during a flight is known with the highest level of certainty. 

Pre-flight fuel quantity checks should use at least 2 different verification methods to determine the amount of fuel on board. When using computed fuel on board and comparing against gauge readings, it is important that calculations are accurate. If any discrepancy is detected between the 2 methods, another method such as filling to a known quantity is required.  

Investigation summary

What happened

On 20 October 2023 the pilot of a Cessna 208 aircraft, registered VH‑UMV and operated by Experience Co, was conducting parachute operations at Barwon Heads Airport, Victoria with 16 parachutists on board. Passing about 500 ft on climb, the pilot detected a partial power loss consistent with a previously‑encountered transient power reduction.

Expecting the power to return immediately, the pilot did not lower the aircraft’s nose to maintain airspeed. The airspeed continued to reduce until the stall warning horn sounded and, due to the low height, low engine power and low airspeed, the pilot attempted to conduct a forced landing. However, the aircraft collided with water before continuing onto the riverbank and ground for approximately 50 m before coming to rest.

The aircraft was substantially damaged, 6 of the parachutists received serious injuries, 8 sustained minor injuries, and 2 were uninjured. The pilot also sustained minor injuries.

What the ATSB found

The ATSB found that passing about 500 ft on climb, the power reduced likely due to abnormal activation of an engine torque and temperature limiting system. Expecting the power to return quickly and surge, and in preparation for turning off the system, the pilot moved the power lever aft to reduce the power setting and delayed lowering the aircraft’s nose to maintain airspeed, resulting in a stall warning and subsequent collision with water.

The ATSB also found that Experience Co’s engine power loss checklist instructed pilots to significantly reduce power in preparation for deactivating the engine limiting system, but did not specify a minimum safe height at which to do so. This increased the risk of a loss of control and/or ground collision. 

Further, the ATSB found that the operator's weight and balance calculation for the accident flight did not include the bench seating weight or moment, and the loadmaster did not load parachutists in positions used for the calculation of the centre of gravity, therefore, although it did not contribute to the accident, the weight and balance was inaccurate for the intended flight. Additionally, the software used to calculate aircraft weight and balance did not provide a warning if individual aircraft zones were overloaded.

Finally, the ATSB found that Experience Co did not ensure sport parachutists received essential safety information about emergency exits, restraints and brace position, prior to take-off. 

What has been done as a result

At the time of writing, Experience Co was re‑developing its sport skydivers safety video to include emergency procedures. Additionally, the following proactive safety actions have been taken:

• A safety communique was developed and circulated at each drop zone reminding parachutists to be seated in accordance with their manifested location.
• Chief instructors, drop zone safety officers and loadmasters were reminded of the loadmasters’ responsibilities to ensure parachutists were seated in accordance with the weight and balance calculation.
• Skydive Operations Manual was amended to clarify the loadmasters’ responsibilities.
• Additional training was provided for manifest staff.
• A fleet-wide audit was undertaken to ensure all aircraft had accurate basic empty weight figures.
• A prompt was added to the internal reporting software to confirm an entry has been made to the aircraft’s maintenance release when submitting a maintenance‑related internal safety report.
• Briefings that cover essential safety information about emergency exits, restraints, and brace position, are now required annually by sport skydivers.
• Additional pilot training relating to the single red line/torque and temperature limiter malfunctions has been developed and was scheduled to be delivered to all pilots.
• Emergency exit signs in all aircraft were being assessed for compliance and effectiveness, and updated if necessary.
• Engineering personnel have undertaken specialised TPE331 Powerplant and Systems training.
• Information circulars were provided to company pilots about the proper defect reporting requirements using the aircraft maintenance release.
• Experience Co was updating advice as to the altitude at which seatbelts must be worn.
• Experience Co has developed Cessna 208 and Cessna 208B aircraft flight manual supplements, which outline the carriage of 17 parachutists and 21 parachutists respectively.
• An additional support bracket has been designed to be fitted to the end of the bench seats in aircraft and will be installed once formally approved.
• A new engine power loss checklist was developed in cooperation with the supplemental type certificate (STC) holder to be followed at or above 1,000 ft above ground level.

The Australian Parachute Federation (APF) has taken the following safety action:

• The APF will ensure skydivers and pilots review their aircraft emergency procedures on a regular basis. Recommended topics are likely to include:
  • general safety around aircraft
  • hot loading
  • door activation
  • achieving correct restraint fitment
  • emergency landings
  • brace position
  • emergency exit altitudes and which parachute to use
  • communication during an emergency
  • for coastal operations, life jacket use in a ditching.
• Each parachuting aircraft operator will conduct a thorough assessment of its aircraft to ensure single point restraints are properly installed, to prevent parachutists from moving outside their designated seating positions and to maintain the aircraft’s weight and balance.
• The APF will review global data on the use of dual-point restraints to gather insights from other national parachuting organisations regarding their experiences with this system.
• The APF examined aircraft flight manual wording of all aircraft currently conducting parachute operations in Australia to identify which aircraft would require a short-term CASA exemption to permit operations with the number of passengers onboard in excess of those able to occupy the normal seats under the type design. They identified 22 aircraft requiring an exemption, spanning 5 operators.
• The APF added the following statement to the participant waiver form: ’parachuting aircraft are not operated to the same safety standards as a normal commercial passenger flight’.

Finally, the Civil Aviation Safety Authority advised that it is developing the following:

• An exemption, for pilots or operators of parachuting aircraft who may be unable to comply with elements of the aircraft flight manual, is expected to be completed by mid‑2025.
  • CASA stated that it was satisfied that reasonable steps had been taken by the APF to ensure that a level of safety, commensurate with the risks involved in the parachuting activities in which participants engage, was provided to those participants in the interim while the exemption was being developed.
• An amendment to the Civil Aviation Safety Regulations Part 21 Manual of Standards to specify the standards required for the modifications made to parachuting aircraft. This proposed action is expected to be finalised by the end of 2025.
• Additional guidance to support aircraft owners and operators seeking to make an approved modification.

Safety message

The ATSB research report Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft provides information to assist pilots to maintain aircraft control in the event of an emergency or abnormal situation after take-off. The report prescribed initial actions to be considered including:

• Lower the nose to maintain the glide speed of the aircraft. If turning is conducted, keep in mind an increased bank angle will increase the stall speed of the aircraft.
• Maintain glide speed and assess whether the aircraft is maintaining, gaining or losing height to gauge current aircraft performance.
• Fly the aircraft to make a landing, given the aircraft’s height and performance, and the pre-planned routes for the scenario.

If time permits, moving the power lever through the full range may result in increased power available to climb and/or create the time to diagnose the issue.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.

One of the safety concerns is reducing the severity of injuries in accidents involving small aircraft. This incident highlights the importance of passengers being appropriately briefed on the brace position and use of emergency exits. It also illustrates the higher injury risk associated with the carriage of parachutists, due to the increased number of occupants and inferior restraints compared to being secured in a certified seat. 

Investigation summary

What happened

On 20 June 2023, a Cessna 310R, registered VH-DAW and operated by Broome Aviation, was being flown on an air transport operation with a pilot and one passenger from Broome Airport to Turkey Creek, Western Australia (WA) and return. On the return flight, the pilot planned to stop at Derby Airport, to refuel.

On the return flight from Turkey Creek to Derby, the aircraft’s right engine began surging while being supplied from the auxiliary fuel tank. The pilot changed the tank selection to the right main tank, which had little fuel remaining. The right engine began surging a second time and the pilot determined there was enough fuel in the left main tank to sustain both engines to Derby. The pilot then selected the right engine to cross feed from the left main fuel tank.

Ten minutes later, both engines began surging. The pilot, assessing they had a dual engine fuel starvation, began switching fuel tanks searching for any remaining fuel. Unable to stop the engine surging, the pilot extended the landing gear and banked into a right turn with the intention of landing on the Derby Highway. During the turn, the right wing of the aircraft contacted a tree causing the aircraft to turn 180° and come to an abrupt stop on the edge of the highway.

The pilot sustained serious injuries, and the passenger sustained minor injuries. The aircraft was substantially damaged. 

What the ATSB found

The occurrence

The ATSB found that the planned flight from Broome to Turkey Creek and return to Derby with the required fixed reserve and contingency fuel could not be achieved without refuelling the aircraft en route. In addition, the pilot did not intend to use all the available fuel in the auxiliary tanks and did not take this into consideration in their pre-flight planning, further reducing the amount of fuel available. Also, the aircraft fuel gauges did not indicate accurately.

The ATSB also found that the pilot inadvertently did not select the fuel supply to the right engine to the right auxiliary fuel tank during the first leg of the journey and did not manage the fuel in accordance with the pilot's operating handbook requirements. This resulted in the depletion of fuel in the main tanks to a level where continuous engine operation could not be maintained.

Further, after the fuel in the right main fuel tank had been used, the pilot did not divert the aircraft to the closest airport, select the left engine to the left auxiliary fuel tank, or maintain altitude to increase their safety margin. Additionally, the pilot was not wearing an upper torso restraint during the forced landing resulting in the pilot receiving serious head injuries during the collision.

The pilot also had a lack of understanding of the aircraft fuel planning, fuel management and emergency procedures, and due to a lack of consolidation training and limited to no operational oversight these issues were not detected.

Operator oversight

The ATSB also found that during the 8-month period from November 2022 until the accident, Broome Aviation provided its pilots transitioning to operating the Cessna 310 with limited supervision, guidance and support, including management of the fuel system. In addition, aircraft defects were not being written on the maintenance release, leading to several defects not being rectified or managed.

Further, Broome Aviation pilots experienced pressure to not report aircraft defects on maintenance releases, and many pilots also experienced or observed pressure from company management to conduct flights in aircraft with defects that they considered made the aircraft unsafe for flight.

Finally, Broome Aviation’s operations manual did not include a procedure for recording in‑flight fuel calculations. As a result, pilots adopted varying methods for fuel monitoring, leading to reduced assurance of accurate in‑flight fuel management.

Civil Aviation Safety Authority oversight

The ATSB identified that, following a complaint by a former Broome Aviation pilot regarding management pressure on pilots to operate unserviceable aircraft, the Civil Aviation Safety Authority (CASA) conducted a level 2 surveillance activity on the operator in early June 2023 with a key scope element being to evaluate the complaint. In addition, CASA received further complaints after the accident, that were also added to a level 1 surveillance activity in August 2023. However, the surveillance activity and the associated reports did not assess the subject of the complaints.

Additionally, CASA approved a head of flying operations (HOFO) for Broome Aviation in early December 2022 via an abbreviated assessment as they had already been assessed for another operator and due to an expectation that it was an interim appointment. The person subsequently remained in the position for a much longer period and, when this situation was identified by CASA, the HOFO’s ability to continue undertaking the position when returning to work for another operator full time as a line pilot and alternate HOFO was not fully assessed.

What has been done as a result

Broome Aviation updated its operations manual to the new format exposition in response to Civil Aviation Safety Authority (CASA) findings during a level 1 surveillance audit. It now outlines an in‑flight fuel management procedure. 

The operator now has both a full-time HOFO and an alternative HOFO, who is also the Safety Manager. The new HOFO reported that all company pilots are fully aware that they are available to address questions or concerns. The operator has also modified its check and training system, implementing a revised check and training procedure and updated documentation to facilitate the tracking of pilot training and competency in line with current Civil Aviation Safety Regulations (CASR).

The new HOFO has changed the defect reporting process to ensure all defects are reported to either the HOFO or the alternative HOFO, and where required noted on the MR. The operator is now using maintenance releases to systematically document defects, ensuring that issues with aircraft in the fleet are properly tracked and addressed.  

Finally, Broome Aviation has implemented a safety management system in line with the current CASR in relation to a CASA audit finding. Monthly safety meetings are now being held to address safety concerns.

Safety message

Accidents involving fuel mismanagement are an ongoing aviation safety concern. In addition to the importance of ensuring there is sufficient fuel prior to, and during, flight, this occurrence reinforces the need to:

• be fully familiar with the aircraft’s fuel system and capacity
• conduct a thorough pre-flight inspection, including verification of the fuel quantity
• ensure the appropriate tank selections are made
• ensure all aircraft documentation and placarding is up to date and readily available.

This accident and many other previous accidents demonstrate the importance of pilots having knowledge of the aircraft type and its systems, especially when faced with an abnormal situation. Operators, as part of their safety management processes, should provide the opportunity for skill consolidation during and following the initial training on a new aircraft type to reduce safety risk during this transition. This is particularly relevant for types with increased complexity compared to those a pilot has previously flown.

Pilots have a vital role in ensuring maintenance personnel are aware of all aircraft defects to enable prompt rectification and compliance with aviation regulations. This includes documenting aircraft defects on the maintenance release (MR) accurately and without omission. Failing to record defects compromises aircraft airworthiness and safety, placing crew, passengers, and operations at unacceptable risk.

Pilots who perceive serious risks, such as defects not being addressed, management pressure to operate defective aircraft, or being discouraged from documenting defects on the MR, are urged to report these concerns through their organisation’s safety management system (SMS). The SMS is designed to provide a structured and confidential channel for reporting safety issues to enable investigation and resolution.

If internal reporting channels are ineffective or unavailable, pilots are encouraged to report safety concerns confidentially to either the Civil Aviation Safety Authority’s confidential reporting system (Reporting illegal behaviour | Civil Aviation Safety Authority) or the ATSB’s REPCON scheme (REPCON – Aviation Confidential Reporting Scheme | ATSB). These reporting systems ensure the identity of individuals is protected, while enabling critical safety issues to be addressed. Accurate reporting of safety concerns and occurrences is essential to preventing accidents and fostering a strong safety culture.

The occurrence

Overview 

On 20 June 2023, a Cessna 310R, registered VH-DAW and operated by Broome Aviation, was being prepared for an instrument flight rules (IFR)[1] air transport operation with a pilot and one passenger from Broome Airport, Western Australia (WA) to Turkey Creek, WA. On the return flight, the pilot planned to stop at Derby Airport to refuel before returning to Broome Airport (Figure 1).

Figure 1: VH-DAW flight plan

Source: Google Earth, annotated by the ATSB

Broome to Turkey Creek

At Broome Airport, the pilot completed flight planning, using software provided by the operator. They then completed the pre-flight checks of the aircraft, including visually confirming all 4 fuel tanks (see the section titled Fuel system) were full. The pilot then delivered a safety briefing to the passenger, which included the use of seatbelts, the location of the emergency locator transmitter (ELT) and the first aid kit.

The aircraft departed Broome at 0542 local time. The pilot supplied fuel to both engines from the main fuel tanks for 60 minutes before selecting the auxiliary fuel tanks. They advised that after 30 minutes, they reselected the main tanks and continued to Turkey Creek. 

The pilot indicated that when switching between fuel tanks, they recorded the duration of usage for each tank and calculated the anticipated fuel consumption on a printed flight plan as the operator did not have a formal inflight fuel log. 

The aircraft landed at Turkey Creek at 0744. The pilot shut down the engines and left both fuel selectors on the main tanks position. The pilot did not check the total remaining fuel on the gauges at that time. Both the pilot and the passenger left the runway strip for approximately 6 hours. The pilot recalled being able to see the aircraft from the building in which they were waiting for the passenger to complete their business.

Turkey Creek to Derby

Upon returning to the aircraft, the pilot completed a fuel quantity check by dipping the main tanks with a dipstick. They recalled that the left main tank had 110 L of fuel, which was in line with what they expected (see the section titled Pre-flight fuel plan). However, the right main tank contained only approximately 70 L of fuel. The pilot turned on the aircraft battery to compare the dipstick readings to the fuel gauge readings and reported that both main tank fuel gauge indications correlated with the dipstick readings. Upon checking the auxiliary tank gauges, the pilot noted the right auxiliary tank gauge was indicating full, 40 L more fuel than expected, and the left was indicating as expected. Due to the design of the auxiliary fuel tanks, the amount of fuel contained in the tank can only be visually verified when the tank is full. The pilot stated they did not visually confirm the fuel level in the auxiliary tanks at that time as they assumed both auxiliary tanks had been used during the flight to Turkey Creek. 

The pilot assumed the difference in fuel distribution between the tanks may have been due to an internal fuel leak from the right main tank to the right auxiliary tank, while they were on the ground at Turkey Creek, which they reported had occurred on a previous occasion (see the section titled Main to auxiliary tank fuel leak). However, the pilot was confident there was enough fuel on board, between all 4 fuel tanks, to fly the second leg of the flight to Derby Airport based off an expected 1.5 hour flight time. The pilot used these revised fuel quantity figures for pre-flight fuel planning and filled in the relevant sections of the journey log. At 1333, the pilot started the engines, taxied out to the runway and at about 1339 departed Turkey Creek with the main tanks selected. 

At about 1439, the pilot switched from main fuel tanks to the auxiliary tanks. Approximately 10 minutes later, the pilot changed the fuel tank selection for the left engine to run off the left main tank. The pilot kept the right engine selected to the right auxiliary tank due to the extra 40 L of fuel they had detected during the pre-flight fuel check. Due to belief that they could only draw fuel for 45 minutes from the auxiliary fuel tanks (see the section titled Limited fuel draw from auxiliary tanks), the pilot calculated there was approximately 30 minutes of fuel available for use in the right auxiliary tank.

At about 1454, (15 minutes after they had selected the right auxiliary fuel tank), the right engine began surging. Unsure why they were unable to run the right engine on the right auxiliary tank for longer, the pilot reselected the right main fuel tank, which resolved the surging. The pilot advised that, as the autopilot had difficulty maintaining altitude (see the section titled Autopilot), they selected it to OFF when the engine issues began. Ten minutes later, the right engine began to surge again. The pilot switched back to the right auxiliary fuel tank, however the surging continued. Now at the top of descent for Derby, the pilot deliberated 2 options: shut down the right engine and fly asymmetrically or crossfeed the right engine to the left main tank and run both engines off the left main tank. 

After checking the fuel gauges, the pilot determined there was enough fuel in the left main tank (approximately 45 L) to run both engines to Derby. The pilot then selected the right engine to crossfeed from the left main fuel tank and referred to the quick reference handbook for engine failure in flight checklist to determine a possible cause for the surging. 

Figure 2: VH-DAW flight path

1. Change from main tanks to auxiliary tanks; 2. Change the left engine from auxiliary tank to main tank; 3. Right engine surge – changed the right engine to right main tank; 4. Right engine surge – crossfeed right engine off left main tank; 5. Inbound call for Derby Airport; 6. Dual engine surge; 7. Mayday call; 8. Accident site. Source: Google Earth, annotated by the ATSB

At 1511, the pilot made an inbound call for Derby Airport on the common traffic advisory frequency. Both engines began surging 3 minutes later. The pilot, assessing they had dual engine fuel starvation, selected the fuel pumps to HIGH and began switching fuel tank selections, searching for any remaining fuel. They advised that after they selected each tank, they waited for a response however, there was no improvement. The pilot advised that the engines did not stop but they could not maintain altitude. 

At 1516:40 the passenger began video recording the flight due to its ‘apparent turbulence’, capturing the engines surging. The recording concluded about 30 seconds later, as the pilot initiated a MAYDAY[2] call to Brisbane Centre air traffic control, stating ‘dual engine failure, suspected engine fuel starvation and I have to put it down on the road’. Brisbane Centre acknowledged the MAYDAY, requested the pilot activate their ELT on landing, and requested details on the number of people on board. The pilot did not respond. 

The pilot alerted the passenger to the emergency and told them to brace for impact. Approximately 30 seconds later, the pilot extended the landing gear and banked into a right turn with the intention of landing on the Derby Highway. However, during the turn the right wing of the aircraft hit a tree causing the aircraft to turn 180⁰ and come to an abrupt stop on the edge of the highway. 

Upon landing, the pilot was temporarily rendered unconscious. The passenger called emergency services and a local passerby stopped to help the pilot and passenger. The passenger recalled the area smelling of fuel when stepping out of the aircraft. 

The pilot sustained serious facial injuries and the passenger sustained minor injuries. The aircraft was substantially damaged. 

Context

Pilot information

Qualifications and experience

The pilot held a commercial pilot licence (aeroplane), issued in December 2020. They also held a multi-engine aircraft (MEA) class rating (issued on 21 June 2021), and an MEA command instrument rating (issued/renewed on 27 August 2021).  

At the time of the accident, the pilot had about 776 hours of total flying experience, with about 613 hours as pilot in command and 43.4 hours as pilot in command of MEA. 

The pilot joined the operator in July 2022, commencing operations on the Cessna 210 (C210). After a period of induction and flying in command under supervision (ICUS), the pilot completed a proficiency check with the substantive[3] head of flying operations (HOFO) (see the section titled Head of flying operations) on the C210 and then commenced passenger air transport operations as pilot in command.

Prior to joining the operator, the pilot had accumulated a total of 37.6 hours on MEA, of which 35 hours were dual day flying and 2.6 hours were dual night flying, completed during the pilot’s initial MEA flight training in 2019. Up until that time, the pilot’s MEA experience had all been gained on the Piper Seminole (PA-44).

In November 2022, the pilot and other pilots from the operator hired an external instructor, at their own expense, to complete instrument proficiency checks (IPCs) on MEA, using VH-DAW. CASA did not require pilots to have a type‑specific endorsement for the Cessna 310 (C310).

By the end of November 2022, the pilot had completed online theory training relating to the basic operation of the C310 and IFR theory, including a Civil Aviation Safety Authority (CASA) MEA questionnaire. On this assessment, the pilot had incorrectly stated the size of the C310 auxiliary tanks (see the section titled Fuel system), and the requirement to use the main tanks for 60 minutes prior to using the auxiliary tanks (see the section titled Fuel management). In mid‑December 2022, when the external instructor visited the organisation for the flight component of the IPC, the instructor assessed the MEA questionnaire using the aircraft’s pilot’s operating handbook (POH). They later advised that they noted the errors, and while they did not correct the answer on the questionnaire, they discussed the correct answers with the pilot.

The pilot’s C310 IPC training included general handling skills, stalls, turns, circuit operations, instrument approaches, asymmetric training, and an outline of how the auxiliary tanks were used. The auxiliary tanks were used for no more than 10 minutes during the first flight. The pilot obtained their IPC on 16 December 2022. The instructor noted that, although fuel management was not explicitly covered during the IPC flights, they had an expectation it would be covered during the organisation’s line training. 

In total, the pilot gained approximately 8.1 hours ICUS on the C310 by the end of December 2022 (Table 1). The pilot then returned to flying the C210 for the operator. 

A check-to-line flight on the C310 was planned to be conducted during a passenger-carrying air transport operation on 21 March 2023, however this flight was cancelled due to a hydraulic malfunction with the aircraft. A shorter, non-air transport operation, check-to-line flight was subsequently conducted by the interim[4] HOFO on 25 March 2023, 130 days after their IPC was issued. The pilot had not flown the C310 in the interim.

The check-to-line flight with the interim HOFO covered various operational aspects, however it was focused on ensuring the pilot was proficient flying under the IFR. The pilot could not recall completing emergency procedures during this flight or using the auxiliary fuel tanks. The pilot was assessed as competent in all areas. At the end of the check-to-line flight, the pilot had accrued 10.5 hours ICUS on the C310.

Table 1: Pilot ICUS hours

After completing the check-to-line flight, the pilot alternated between operating the C210 and the C310, accumulating 37 hours on the C210 and 43.4 hours on the C310 prior to the accident. At the time of the accident, the pilot had 53.9 hours experience on the C310, including 43.4 hours in the 90 days prior to the accident. 

Recent history

In the 7 days prior to the day of the accident, the pilot completed flights on 14 June (4.6 hours flight time), 15 June (1.9 hours flight time), and 17 June 2023 (5.1 hours flight time). The pilot was rostered off duty on 18 and 19 June. They were within the operator’s flight and duty limitations for maximum cumulative flight and duty times in the 7 days prior to the accident (20 June). 

The pilot reported that, on the evening of 19 June, they retired to bed at 2030, woke up at 0300 and began their pre-flight duties at 0500. The pilot noted that they went to bed earlier than normal, due to the early start time, but could not fall asleep straight away. It is likely they obtained about 5–6 hours of sleep.

The operator’s operations manual[5] detailed that, when starting between 0500–0559, pilots had a maximum available flight duty period (FDP) of 9 hours. Due to the pilot being on the ground at Turkey Creek for 6 hours, the operator reported they had organised a suitable sleeping accommodation for the pilot to allow for a split shift. This arrangement allowed the pilot’s FDP to be extended by 4 hours. The pilot was unaware of this facility, stating the operator had never previously given them suitable sleeping accommodation during a long day shift, only when needing to stay overnight. The pilot reported they waited for the client in an air‑conditioned room and had an adequate amount of food. 

The pilot reported that they felt somewhat rested during the day of the accident flight and recalled that, although they had gone to bed early, they had not fallen asleep straight away. Based on the available information, the ATSB concluded that the early wake-up time and long duty day were problematic but, overall, there was insufficient evidence to conclude that the pilot was experiencing a level of fatigue known to affect performance.

Medical information

The pilot held a class 1 aviation medical certificate that was current to 3 May 2024. This specified a requirement for the pilot to wear distance vision correction. The pilot stated that they did not have any medical concerns or issues in the period prior to the accident.

Aircraft information

The Cessna 310R is a twin-engine, low-wing, 6-seat, unpressurised aircraft equipped with retractable landing gear and powered by 2 Continental IO-520 piston engines. VH-DAW was manufactured in the United States and first registered in Australia in 1975. Broome Aviation became the registration holder on 12 July 2011.

Fuel system

The C310 fuel system consists of 2 sets of fuel tanks in the wings – main and auxiliary, that supply fuel to each engine independently. Two fuel selectors, one for each engine, are installed on the floor between the pilot seats. These allow selection of main fuel, auxiliary fuel, crossfeed and fuel shutoff (Figure 10). The selector allows fuel to flow from the selected fuel tank to the engine‑driven fuel pump for the selected engine. Figure3 shows the layout of the standard fuel system installed in the aircraft.

Figure 3: VH-DAW Fuel System

1. VH‑DAW was fitted with both optional auxiliary tanks, totalling 31.5 US gallons on each side; 2. The aircraft did not have the optional low level fuel light fitted. Source: C310 POH, annotated by the ATSB

Main tanks

The 2 main fuel tanks for the C310 are integrally‑sealed aluminium tanks located on each wing tip. Each main tank holds 189 L (50 United States (US) gallons) of usable fuel, with approximately 7.5 L of unusable fuel. There are 2 fuel pumps in each main tank, the first (auxiliary fuel pump) is used to provide fuel pressure to prime the engine for start or to provide fuel pressure during an engine‑driven fuel pump failure. The second (transfer pump), operates continuously during flight and allows the transfer of fuel from the nose section to the centre section of the main tank, where the fuel outlet is positioned. The transfer pumps are on the same electrical circuit as the left landing light. The main tanks are vented to atmosphere and if overfilled, fuel will be vented overboard through these vents.

Auxiliary tanks

The auxiliary fuel tanks are bladder‑type tanks and are located in the outboard section of each wing. Each auxiliary tank holds 119 L (31.5 US gallons) of usable fuel. The POH stated that fuel could be drawn from the auxiliary tanks during cruise flight only. 

Engine-driven fuel pump

Each engine had an engine‑driven fuel pump that contained a bypass, which continuously returned excess fuel and vapour to their respective main tank.

Fuel management

The POH stated:

If auxiliary fuel tanks are to be used, select main fuel for 60 minutes of flight (with 40-gallon auxiliary tanks) or 90 minutes of flight (with 63-gallon auxiliary tanks). This is necessary to provide space in the main tanks for vapor and fuel returned from the engine-driven fuel pumps when operating on auxiliary fuel. If sufficient space is not available in the main tanks for this diverted fuel, the tanks can overflow through the overboard fuel vents.

It also stated:

Since part of the fuel from the auxiliary tanks is diverted back to the main tanks instead of being consumed by the engines, the auxiliary tanks will run dry sooner than anticipated; however, the main tanks endurance will be increased by the returned fuel. The total usable fuel supply is available during cruise flight only. An engine failure or engine driven fuel pump failure results in the auxiliary fuel on the side of the failure to be unusable.

It was recommended that auxiliary fuel was used until either exhausted or the flight phase had reached the top of descent. When questioned by the ATSB, neither the engine nor aircraft manufacturer could provide a fuel flow rate to calculate how much fuel was being returned to the main tank when the auxiliary tank was selected. The POH also advised ‘operation of the auxiliary fuel tanks near the ground (below 1,000 ft) is not recommended’.

The pilot advised that to simplify fuel management, they routinely used the main tanks for 60 minutes on each segment of a flight before selecting auxiliary tanks. They did not mention the reasoning behind using 60 minutes rather than the expected 90 minutes associated with the larger auxiliary fuel tanks (as fitted to VH‑DAW) detailed in the POH. Other pilots within the organisation who flew the C310 also reported using the 60-minute timeframe.

Fuel flow gauge

The fuel flow gauge indicated the approximate fuel consumption of each engine in pounds per hour. The POH stated that the gauge dial is ‘marked with arc segments corresponding to proper fuel flow for various power settings and is used as a guide to quickly set the mixtures. The gauge has markings for take-off and climb, and cruise power settings for various altitudes.’

The pilot advised that they used the fuel flow gauge while leaning the engines to determine the engines were receiving the appropriate fuel flow and to ensure the flow was stable after changing fuel tanks. The pilot reported that this process was completed during the accident flight on all tank changes.

Fuel quantity gauge

One fuel quantity gauge was located above the right-side control column and indicated the weight of the fuel (in both US gallons and pounds) for the left and right fuel tanks on the display. The gauge showed the fuel quantity for the selected tanks (either main or auxiliary) and the fuel quantity in the non-selected tanks could be displayed through the use of a toggle switch below the gauge. There were also 2 yellow indicator lights (one for each side), these illuminated when the auxiliary tank on the selected side was selected (see Figure 7).

The aircraft was not equipped with the optional independent low fuel warning lights for the main fuel tanks. 

Vortex generators

VH-DAW was fitted with 88 vortex generators located on the wings and vertical fin with additional strakes mounted on the outboard of each engine nacelle. The Supplemental Type Certificate (STC) for this modification included various amendments to the limitations and performance, including reduced stall and V_MCA[6] speeds, and allowed for an increased operating weight. 

Site and wreckage

Accident site

The ATSB did not attend the accident site. The site was attended by members of the Western Australia (WA) Police Force on 20 June 2023 and by the aircraft operator the following day. The site inspection was recorded by the police and the video footage was provided to the ATSB, along with photographs taken on the day of the accident (Figure 4).

Figure 4: Accident site

Source: Western Australia Police Force

The wreckage was located on the edge of the road in an area of low foliage, approximately 2.8 NM (5.2 km) east-south-east of Derby Airport. The left main tank and right auxiliary tank were ruptured during the accident sequence. 

The left auxiliary tank was reported by the operator as being intact and found to contain about 20 L of fuel, while the right main tank contained negligible amounts of fuel. As both wings displayed visible damage (Figure 5), the ATSB was unable to verify if fuel had leaked from the fuel tanks following the ground collision. The propellers on both engines were not in the feathered position. 

Figure 5: Left and right wing damage

Top image – left wing; bottom image – right wing. Source: Western Australia Police Force, annotated by the ATSB

While reviewing the video footage taken by the police onsite, the left landing light circuit breaker was found to have tripped. The ATSB could not verify if this occurred due to ground impact forces or during the flight. 

The operator arranged for the wreckage to be transported to a non-secure storage area at Broome Airport, which required the wings and one horizontal stabiliser to be separated from the fuselage. 

ATSB examination 

On 30 June 2023, the ATSB examined the wreckage focusing on the aircraft fuel system, particularly the right wing, both auxiliary fuel tanks, and the fuel quantity indicating system (FQIS). Despite the disruption during the accident sequence and transportation, no pre-existing defects or fuel system anomalies were identified. The following key components were retained for further examination and testing:

• right and left auxiliary interconnect check valves
• right and left vapour return check valves
• right fuel selector mains inlet port
• right fuel selector auxiliary inlet port
• FQIS indicator and signal conditioner.

Detailed technical examination of these components identified the following defects in 3 components, which likely existed prior to the accident:

• right fuel selector – main tank inlet valve did not seal when closed (i.e. when not selected ON)
• the check valve in the right auxiliary tank outlet bleed return line (interconnecting the inboard and outboard fuel cells) did not seal in the reverse flow direction
• the right vapour return line (engine driven fuel pump to main tank) check valve did not seal in the reverse flow direction.

Testing of the check valve in the right auxiliary tank vent outlet bleed return line in the reverse direction identified a small leak. However, the testing indicated that the leak rate was significantly less than that required to allow fuel to have transferred from the main tank to the auxiliary tank while the aircraft was on the ground at Turkey Creek in the quantities reported by the pilot.

Civil Aviation Safety Authority (CASA) Airworthiness Bulletin (AWB) 28-010 stated that if this valve was leaking, it could allow the engine‑driven fuel pump to draw air into the fuel system resulting in either engine surging or loss of power. It was reported that this is most likely to occur when the auxiliary tank quantity was less than about half full.

The differential pressure applied to the check valve during testing was likely far lower than expected operating pressures. Therefore, it is possible that during engine operation with the auxiliary fuel tank selected, as the fuel quantity reduced, the increased system pressure affected the leak rate and resulted in an increased reverse flow. This may allow the engine driven fuel pump to draw air in sufficient quantity to effect engine performance.

There was no evidence of defects in the auxiliary tank inlet valve of the right fuel selector or the corresponding check valves from the left fuel system. The left fuel selector was not implicated in the occurrence and was therefore not tested.

The FQIS indicator and signal conditioner were not tested or examined due to difficulty finding a facility capable of testing the signal conditioner. Although testing may have established the serviceability status of these individual components, aircraft accident damage prevented operational testing of the whole system. As such, evidence provided by pilots that the FQIS system was not indicating correctly was relied upon (see section titled Fuel gauge displays).

Aircraft maintenance

Maintenance release 

A maintenance release (MR) is required to be carried on an aircraft as an ongoing record of the aircraft’s time-in-service and airworthiness status. The operator’s system of maintenance stated that the MR was valid for 200 hours in service or 12 months from issue, with inspections to be completed at 50, 100, 150 and 200 flight hours. 

A daily inspection was required to be carried out and the MR signed to show the inspection had been completed, prior to the first flight of the day. The inspection and certification could be made by any pilot licenced to fly the aircraft, or an appropriately licenced aircraft maintenance engineer. After the last flight of the day and before the aircraft was next flown, the total daily flight time was required to be entered and the progressive total time in service recorded.

The MR is also used to record any maintenance which is due on the aircraft prior to the next periodic inspection, or any defects[7] detected. 

The last periodic maintenance inspection was carried out on 11 May 2023 at 150 flight hours. At that time the aircraft total time in service was 18,630 hours. The aircraft had flown 30 hours since this inspection with no defects recorded. The only maintenance issue recorded on the MR was a hydraulic leak in the right main brake, which was rectified and signed off by a maintenance engineer on 24 April 2023. 

The ATSB interviewed all 5 pilots who had flown the operator’s C310 during the period from December 2022 to June 2023, as well as other pilots who flew the operator’s C210s. Most of the pilots interviewed stated they were encouraged not to write any defects with aircraft on the MRs. These pilots recounted that if any defects were documented on a MR, they would be reprimanded by the CEO and face a reduction in flight hours on the subsequent roster. 

The pilots also reported that the interim HOFO (see the section titled Head of flying operations) exhibited more willingness for defects to be documented on the MR, however they firstly required assurance that the reported matter was a legitimate defect. The pilots had mixed views on the stance of the substantive HOFO, with 3 noting they had been told not to write defects on the MRs. Two pilots stated they had attempted to implement a ‘snag’ recording system as an alternate method of recording defects, however this was never adopted.

Most pilots advised that, to circumvent what they assessed as a restriction on using the MRs to record defects, they utilised a group chat to communicate specific issues they had encountered on different aircraft in the fleet. They also noted they found it easier to directly communicate with engineers in the maintenance facility if they had any issues after they completed a flight. This approach usually resulted in minor defects getting fixed immediately. 

The substantive HOFO stated they were unaware of any ongoing defects with the operator’s C310 and were unaware of any instances of the CEO reprimanding pilots due to the recording of defects on the MRs. They also stated that, on occasion, pilots deviated from the standard documented procedure for defect reporting (see the following section titled Defect reporting process). 

The interim HOFO also noted that any defects with aircraft in the fleet should have been reported to them and put on the MR, although even if this was not the case then pilots could go straight to the engineers in the maintenance facility to get the matters rectified. In relation to the C310, the HOFO stated the aircraft fuel gauges ‘weren’t fabulous’, however they did not offer an explanation why this was not written up on the MR. They reported being unaware of any other aircraft defects.

The chief engineer advised that all defects would be reported to them by either the HOFO or the CEO using the operator’s defect reporting process. Contrary to the process advised by the pilots, the chief engineer advised that as Broome Air Maintenance was not a part of Broome Aviation, all rectification work had to be requested, and that pilots were not permitted to bypass the request. 

The CEO stated that if there was a defect with an aircraft, they would have expected the pilots to follow the company’s policy regarding defects and write them on the MR. When asked about the C310, the CEO recalled having no knowledge of any defects with the aircraft other than the autopilot not holding altitude. No reason was provided as to why this was not written on the MR. The CEO reported that the fleet were maintained to a high standard and that if a pilot found a defect on an aircraft it would be delt with accordingly. They dismissed the reports they would reprimand pilots for reporting defects, noting they were ‘pedantic’ about maintenance. 

Defect reporting process

The operator’s operations manual outlined a formal process to report deficiencies detected between periodic inspections, which stated:

Line pilots shall report any deficiencies to the [head of flying operations] HOFO, [head of maintenance control] HAMC and CEO via email; verbal or text message notification may be used as a secondary notification method where appropriate or required.

Once an email was received from a pilot, the process required the HOFO to liaise with the HAMC to determine the steps to investigate and rectify the deficiency. The substantive HOFO advised that if a pilot were to call with an issue, if required, the HOFO would tell the pilot to endorse the issue on the MR and then the HOFO would follow up with engineering personnel.  

The chief engineer reported that they did not use the maintenance release to record defects. Rather, if defects were identified either by the operator or by the maintenance organisation, these defects would be rectified and recorded in the aircraft’s Broome Air Maintenance (BAM) worksheets. The ATSB inspected the aircraft logbooks and was unable to identify any unscheduled maintenance. The last unscheduled maintenance recorded in the logbooks was dated 2017.

The interviewed pilots stated that if they detected an aircraft defect, it was easier to talk directly to individual engineers in the maintenance facility, as they were usually in the hangar when returning from a flight and it was more likely to be dealt with.

Reported aircraft issues

The operator’s pilots reported multiple issues with the aircraft to the ATSB, including:

• inaccurate fuel gauge displays
• an internal fuel leak from the right main tank to the right auxiliary tank
• limited fuel draw from the auxiliary tanks
• engine surging
• inability of the autopilot to accurately maintain an assigned altitude
• significant tail flutter. 

During an interview with the ATSB, the chief engineer reported that, to their knowledge, the aircraft was fully serviceable with no issues identified. They also advised they were not aware of the issues raised by the pilots.

Fuel gauge displays

Fuel calibration cards are aircraft specific and used to enable an accurate assessment of fuel quantity. The aircraft’s dual indicating fuel quantity gauge was last tested and calibrated on 24 June 2020. Pilots reported that the main tank calibration card was disregarded as it was considered inaccurate. 

There was no fuel calibration card relating to the auxiliary tanks. The ATSB was unable to confirm if the auxiliary tank calibration had occurred as there was no record in the maintenance worksheets or the aircraft logbook of the results. There was no regulatory requirement to record the results of a fuel gauge calibration test.  

The next due date to test and recalibrate the fuel gauges was expected to be in June 2024 in compliance with the CASA Civil Aviation Order (CAO) 100.5 General requirements in respect of maintenance of Australian Aircraft – 2011 and the operator’s system of maintenance. 

Pilots who operated the aircraft reported that the fuel gauges displayed significant inaccuracies when the tanks were full. Specifically, when the main tanks were full, the right main tank display would exceed full scale deflection, while the left main tank display would under‑read by approximately 64 L (105 lbs) (Figure 6). 

Figure 6: VH-DAW main tank fuel gauges

Left image – expected fuel gauge indications for main tanks when full; right image – the reported fuel gauge indications for main tanks when full. Source: Braden Blennerhassett (Air Manager), edited by the ATSB

It was reported that, as fuel was used during the fight, the displays became progressively more accurate, however there was still a large discrepancy between the displays (Figure 7). The expectation was that, when the fuel tank selection was changed from main to auxiliary or vice versa, both sides would be changed at the same time.

Figure 7: VH-DAW main tank fuel gauge indications after supplying the engines for the same time

Both the left and right main tanks had been used for the same amount of time during the flight. Source: Pilot of VH-DAW, annotated by the ATSB

It was reported that when the gauge was selected to the auxiliary tank display, there was also a discrepancy when the tanks were full, although the difference was not as significant as that observed with the main tank display. It was reported that the display for the left auxiliary tank under‑read by approximately 9 L (15 lb), while the display for the right auxiliary tank under‑read by approximately 36 L (60 lb) (Figure 8). Pilots did not indicate that the accuracy of the auxiliary tank gauge displays improved during use. However, it was noted that the auxiliary tanks were never used below about 12 L.

Figure 8: VH-DAW auxiliary tank fuel gauges

Left image – expected fuel gauge display for auxiliary tanks when full; right image – reported fuel gauge display for auxiliary tanks when full. Source: Braden Blennerhassett (Air Manager), edited by the ATSB

The fuel gauge inaccuracy was reported to be widely known by pilots and informally reported to individual engineers in the maintenance facility, however the defect was not recorded on the aircraft’s MR. Pilots reported that maintenance personnel informed them that the external organisation capable of fixing the gauges indicated that new sensors were needed, and that the process of fixing the gauge was lengthy and the necessary parts were costly and so it was unlikely it would be completed. The CEO stated they were unaware of any issues with the fuel gauges.  

The pilots advised that they adopted a time-based approach to track the amount of fuel in each tank during flight, noting there was no other guidance from the interim HOFO or senior management on how to manage the fuel quantity. Pilots stated that the most accurate way to ensure the known quantity of fuel on board prior to take-off was to depart Broome with full main and auxiliary tanks and, where possible, fill the main tanks to full when flying intermediate sectors.  

The aircraft minimum equipment list (MEL) allowed 1 display on the gauge to be inoperative[8] providing a reliable means was established to ensure that the fuel quantity on board met the requirements for the intended flight.

Main to auxiliary tank fuel leak

The pilot of the accident flight and the supervisor of their first ICUS flight reported there were occasional instances where, having been fully refuelled, the right main tank would be missing approximately 10–30 L of fuel the following day. They further advised that when this occurred, the right auxiliary tank would overflow when the fuel cap was removed (Figure 9). This led the pilots to suspect a fuel leak between the right main and auxiliary tanks.

Figure 9: Auxiliary fuel tank overflowing on morning inspection

Source: Previous operator pilot, annotated by the ATSB

This issue was informally reported to maintenance staff, but not recorded on the MR. The CEO reported being unaware of the issue. After the initial report, the reporting pilot noted that engineers in the maintenance facility were unable to identify a fuel leak. Although the issue reportedly recurred, it was not further reported.

Limited fuel draw from auxiliary tanks

The pilot of the accident flight stated that the auxiliary fuel tanks could only supply the engines for 40–45 minutes before surging occurred. They noted that their initial understanding of the limited fuel draw came from the supervisor of their first ICUS flight. They further advised observing this limitation on their first solo passenger-carrying flight in the aircraft.

This issue was informally reported to individual engineers in the maintenance facility by the supervising pilot, and they recalled that maintenance was unable to identify a cause. The pilot of the accident flight assumed that since the issue had been reported previously, it had been addressed by maintenance. However, both the CEO and the chief engineer advised being unaware of the issue. 

Other pilots stated that around the 40-minute mark while using auxiliary tanks, the aircraft’s engines would lightly surge before regaining power. They would then continue to use the fuel from the auxiliary tanks until about 12 L remained, before changing to the main tanks. The HOFO reported there were no issues when using the auxiliary tanks. 

Engine surging

Multiple pilots recalled that the engines would surge during flight. The pilot of the accident flight and one other pilot noted the surging generally occurred when operating on auxiliary tanks, which they attributed to the limited fuel draw issue. 

Other pilots also recalled the engines surging however, they could not confirm which tanks were selected at the time. These surges were described as minor and intermittent, typically ceasing after a few seconds and did not require the fuel pumps to be selected ON.

The engine surging had been reported to individual engineers in the maintenance facility verbally and had not been documented on the MR. Both the CEO and the chief engineer advised that they were unaware of this issue. 

Autopilot altitude hold

According to pilots who operated VH-DAW, the aircraft’s autopilot maintained an accurate heading, however, despite pre-flight testing of the system reportedly consistently indicating that the autopilot was fully operational, it could not maintain an assigned altitude. There was no evidence or record that this issue was formally or informally reported to the engineers in the maintenance facility, and the chief engineer advised not being aware of the issue. However, the issue was known to the organisation’s CEO, at the time of the occurrence.

An autopilot was considered inoperative if it was unable to maintain both altitude and heading. The aircraft MEL allowed continued operation with the autopilot inoperative under any one of the following conditions:

• if flight was operated under IFR rules for RPT, charter[9] or aerial work, the aircraft was equipped with dual controls and had 2 control seats, with one control seat occupied by the pilot in command of the aeroplane and the other seat occupied by a person holding a commercial pilot (aeroplane) licence with an endorsement on the aircraft and an instrument rating
• if the flight was operated under IFR rules with a single pilot for RPT, charter or aerial work, the flight was within the period of 3 days commencing on the day on which the autopilot became inoperative provided only one capability of the autopilot system was unserviceable
• the flight was operated under VFR rules
• the flight was operated for a private flight.

Elevator flutter

Pilots reported the presence of a known elevator flutter[10] on the aircraft, which was attributed to the installation of vortex generators on the elevator. This flutter resulted in challenging handling characteristics at low speeds, particularly during take-off and landing. 

The engineers in the maintenance facility had conducted an extensive investigation into the issue in 2018, including the removal and reinstallation of the vortex generators. They concluded that the flutter did not impose stress on the airframe, and the aircraft was returned to service on 13 August 2018. The vibration defect was raised again on the MR on 20 October 2022 and cleared by maintenance personnel on 4 November 2022. There was no information regarding what was completed during the November sign‑off. The pilot of the accident flight stated that the elevator flutter was still present, although not noted on the accident flight.  

Aircraft placarding

The fuel selectors had plaques stating the amount of fuel in each tank in US gallons. On inspection, it was noted that the auxiliary tank capacity for both sides incorrectly indicated that small auxiliary tanks (20 US gallons) were fitted to the aircraft (Figure 10). 

Figure 10: VH-DAW fuel selector plaques

Source: Operator, annotated by the ATSB

This contradicted the usable fuel decals next to each filler cap on the airframe, which identified that the auxiliary tanks held 119 litres (31.5 US gallons) (Figure 11). 

Figure 11: VH-DAW fuel decals

Source: ATSB

Just above the fuel selector plaques, there was a requirement for a plaque specifying how long to operate on the main tanks when first taking off with full tanks. For a C310 with the larger auxiliary tanks, the plaque was required to include:

Use main tanks for takeoff, landing and first 90 minutes of flight.

This plaque was missing from the aircraft (Figure 12). 

Figure 12: VH-DAW internal placards relating to the fuel system

Top image – VH-DAW internal fuel placarding; bottom image – exemplar internal fuel placarding. Source: Top image – ATSB; bottom image – Textron, annotated by the ATSB

All aircraft placarding was required to be checked under the aircraft system of maintenance every 200 hours for security, presence and legibility. There was no requirement to check the validity of the information presented on the placards. The aircraft had five 200‑hourly maintenance events in the last 5 years, the last being August 2022. 

The fuel selector placards had last been replaced on 24 October 2008, prior to the aircraft being registered to Broome Aviation. The installed placards were the incorrect part number and as such displayed the incorrect size of the auxiliary tanks. The ATSB was unable to determine if the plaque relating to the 90 minutes on mains had been removed previously or never installed. 

The pilot of the accident flight was unaware that any of the plaques were incorrect, noting that they had not discussed it with the instrument proficiency check (IPC) instructor (see the section titled Qualifications and experience) or HOFO. 

Fuel management

Pre-flight fuel plan

The flight plan used by the pilot on the day of the occurrence was destroyed during the accident and was not recorded by the operator’s planning software. During the draft report review process the pilot advised that they had recently found a copy of the flight plan, which they provided to the ATSB. The plan (Figure 13), generated by the flight planning software, showed a zero fuel margin. The pilot stated that they did not input the expected winds for the flight as they were unaware how to. Additionally, they recalled that all their previous flight planning had been conducted with nil wind. 

Figure 13: Accident flight fuel plan

Source: The accident pilot

A pre-flight fuel plan was created using the operator’s software (Figure 14). The flight plan software used a 120 L/h fuel burn for cruise and 150 L/h for climb. These figures were extracted from the POH performance tables using the typical operating conditions encountered for different phases of flight when flying out of Broome Airport.[11]

The known winds on the day of the occurrence were used. The fuel plan showed that the aircraft could not legally fly with the required reserves on the return flight to Derby.

Figure 14: Example fuel plan based off reported winds for each sector of the occurrence flight

Trip T – Trip total less taxi fuel; Contin – Contingency fuel (15% of expected trip total); F. Reserve – Fixed reserve; Fuel R – Fuel required for next leg including contingency and fixed reserve; Margin – Endurance subtracting fuel required; Endce – Endurance. Source: Operator, annotated by the ATSB

The ATSB also generated a fuel plan based on the pilot’s understanding of the amount of fuel they could use from the auxiliary tanks. The analysis used:

• the flight times calculated by the operator’s software
• the pilot’s standard use of 40 minutes from the auxiliary tanks
• 1.5 x fuel burn rate[12] – the extra fuel was diverted to the main tanks.

This resulted in approximately 120 L of fuel being available for use from the auxiliary tanks (40 L plus the redraw of 20 L = 60 L from each auxiliary tank). Therefore, the pilot’s perceived total available fuel onboard when all tanks were full was 498 L (main tanks 378 L + auxiliary tanks 120 L). As shown in Table 2, such a plan indicated there was insufficient fuel onboard to conduct the flight without fuel starvation. 

Table 2: Fuel calculation comparison

A previous pilot of the C310 indicated that when flying the same route, on the return leg they would refuel the aircraft at Halls Creek, another base for the operator, as it was 77 NM south-west of Turkey Creek. They would then fly directly from Halls Creek to Broome. This flight route ensured they had enough fuel to complete the flight with reserves intact.

Previous flight

The pilot recalled completing the same flight 4 weeks prior to the occurrence. They stated that they had landed at Derby and refuelled the aircraft for the final leg back to Broome. A retrospective fuel log was created using the known winds on that day and the pilot’s reported timing of the fuel tank changes (Table 3). The ATSB also calculated the average fuel burn for the aircraft during this flight using the fuel added to refuel the aircraft to full after the flight which showed the aircraft used an average of 124 L/h.

The operator’s standard 12 L taxi fuel was used for the first leg of the flight. Due to the prevailing wind, the first leg from Broome to Turkey Creek was recorded as having a duration of 126 minutes, requiring the pilot to use the auxiliary tanks for 40 minutes (66 L draw from auxiliary tanks and 22 L returned to the main tanks on both sides). 

The flight time from Turkey Creek to Derby was recorded as 90 minutes. Due to the assumed auxiliary tank issue and having used the auxiliary tanks for 40 minutes on the first leg, the pilot would have likely used main tanks for the entire leg. It is highly probable that the pilot landed at Derby with 21 L of useable fuel remaining in each of the main tanks, equating to about 15 minutes of remaining engine operation before fuel exhaustion. 

Table 3: Retrospective fuel log of previous flight Broome – Turkey Creek – Derby on 25 May 2024 

Fuel quantity analysis of the accident flight

The ATSB obtained flight data that was transmitted at regular intervals from a V2 Flight Tracker, which had been installed on the aircraft. A retrospective fuel log for the Turkey Creek to Derby leg (Table 4) was created using:

• the pilot’s recalled amount of fuel in each tank on startup
• the pilot’s recollection of when they completed tank changes
• the operator’s average fuel consumption rate of 120 L/h
• a conservative estimate of fuel return (0.5 multiplier) to the main tanks when using auxiliary tanks
• a conservative estimate of fuel draw from the left main tank (2.5 multiplier) and return to the right main tank (0.5 multiplier) when cross feeding the right engine.

As such, it is only indicative of the fuel on board in each tank at each change of tank and at the time of the dual engine surging. 

Table 4: Retrospective fuel log of remaining fuel in aircraft from Turkey Creek to the point of the dual engine surge using 120 L/h

At the point of dual engine surge, it is estimated that the left main tank had approximately 9 L of fuel remaining.

The aircraft manufacturer stated that if the engines were surging while on the main tanks and there were no other issues with the fuel system and fuel available in the auxiliary tanks, the pilot should have been able to use the remaining fuel in the auxiliary tanks to regain full power. At the point of the dual engine surge, the left auxiliary tank had approximately 59 L and the right had approximately 97 L available. 

The same calculations were completed using the pilot’s average fuel consumption rate of 124 L/h (see the section titledOperator fuel flow check). Those calculations (Table 5) indicated that about 6 L of fuel remained in the left main fuel tank (supplying both engines) at the point of the dual engine surging.

Table 5: Retrospective fuel log of remaining fuel in aircraft from Turkey Creek to dual engine surge using the pilot’s average 124 L/h

Operator fuel planning requirements

Pre-flight

The operator’s procedures required the pilot to complete pre-flight fuel planning using the available electronic flight planning software. However, if the flight planning software was not available, the pilots were required to calculate the fuel required for the flight using the fuel flow guidelines for the aircraft. 

The operations manual outlined the fuel figures, specific to the C310, to be used when manually completing fuel planning. The guidelines did not contain a fuel flow rate for climb. However, they did include a block (total) fuel margin of 47 L which was to be available for each sector. The operator advised they were not aware of where the margin of 47 L figure had originated from. The electronic flight planning software did not include this 47 L margin fuel when calculating fuel requirements. 

To confirm the amount of fuel on board prior to flight, the operator’s fuel policy required pilots to visually confirm the fuel quantity in each tank using a dip or drip stick when possible, then compare this to the flight plan and fuel gauges. If there was a discrepancy more than an allowable margin with the fuel gauges the pilots were required to inform the HAMC and/or HOFO to determine the possible cause. The allowable margin quantity was not listed in the operator’s fuel policy. 

Inflight

The operator’s procedures required pilots to recalculate fuel in flight at 2 specific points:

• when reaching cruise
• if required to divert.

The procedures outlined that once reaching cruise altitude pilots should: 

calculate the remaining quantity of fuel on board for the proposed destination. This must be equal to or above the legal minimum final reserve quantity. If this is not the case, consider using more conservative fuel power settings, change cruise level for more favourable winds or divert to an alternative. 

The procedure did not stipulate if this calculation was required to be recorded on any documentation, nor did it outline any requirement for a fuel crosscheck. Additionally, the operator did not have a fuel log or method of monitoring fuel during the flight.

If the pilot was required to divert, inflight fuel replanning was to be carried out using the fuel flow guidelines for the aircraft. 

A previous pilot for the operator stated there was no standardised method of completing inflight fuel logs and it was based on pilot preference. They further reported a ‘feeling’ that the organisation had not had any fuel starvation events due to ‘luck’.

Post-flight

The operator’s procedures recommended that pilots conduct a fuel gauge check against the value on the fuel totaliser at the completion of a flight. However, the operator stated that none of its aircraft were fitted with a fuel totaliser. Additionally, the quantity of fuel used was to be checked against the expected burn from the flight plan. 

Pilots were required to complete the fuel documentation, including recording on the journey log and manifest the amount of fuel at shutdown. The manifest did not provide the option to indicate the remaining fuel in each tank. 

Operator fuel flow check

The operator reported that pilots were required to enter the amount of fuel consumed and flight time after each flight into the organisation’s data recording software. The program created a monthly report, which outlined the fuel flow rate for each flight, segregated by aircraft.

The substantive HOFO used this information to determine the average fuel flow for each aircraft, and which pilot completed each flight. If there was an unexpected trend for a particular pilot, the substantive HOFO would use this to discuss how the pilot was configuring the aircraft’s fuel system during flight. If the trend was over multiple pilots, the HOFO would liaise with maintenance to determine the cause.

The substantive HOFO noted there was no indication that the aircraft was burning more than the expected 120 L/h however, they could not confirm if this process was being completed by the interim HOFO while they were on leave. ATSB analysis of the pilot’s flight times and fuel uplift over the previous 10 flights indicated the aircraft was using 124 L/h on average. 

Regulatory requirements

Pre-flight fuel planning

According to Civil Aviation Safety Regulation (CASR) Part 135 Australian air transport operations – smaller aeroplanes section 135.205 operators are required to provide pilots with an exposition which provides comprehensive tools, procedures, and guidance for effective pre-flight fuel planning. The exposition must outline step-by-step instructions for calculating fuel requirements to ensure compliance with Australian regulations and operational safety.

According to CASR Part 135.D.6 and the Manual of standards (MOS) Part 135 7.04, pilots must have access to resources for determining fuel needs for each phase of the flight, including:

• taxi fuel
• trip fuel
• holding fuel
• destination alternate fuel
• contingency fuel
• final reserve fuel

There should also be a process outlining:

• fuel calculations
• determining and recording fuel quantities – pre-flight
• recording fuel quantities.

To support these calculations, operators must provide tools such as flight planning software, fuel calculation tables, or automated planning systems. Operators are also responsible for ensuring that pilots are trained to use these resources effectively and can adjust their fuel requirements based on dynamic operational factors, such as deteriorating weather or delays.

Part 135 manual of standards (MOS) Section 7.03 (2) required that the pilot in command must consider the effect of the relevant meteorological reports and forecasts when determining the quantity of useable fuel.

In-flight fuel management

The Part 135 MOS Section 7.05 (2) required that the exposition outline a process for regular inflight fuel checks, which required the pilot to:

• determine the amount of fuel remaining
• analyse planned fuel consumption against actual consumption
• determine there is sufficient fuel on board
• calculate the amount of fuel expected to remain at the destination. 

According to the CASA Advisory circular 1-02 V4.1 Exposition and operations manual fuel policy guidance Annex D, the exposition should detail what maximum discrepancy between the actual fuel on board (gauge / visual) and calculated (journey log) figure is tolerable, noting that industry practice is a maximum of 3% discrepancy.

Part 135 MOS section 7.03 required that operators must provide pilots with aircraft‑specific fuel consumption. This could be sourced from the aircraft/engine manufacturer or taken from recent historical consumption records. Operators should also require pilots to document any significant deviations in fuel consumption or incidents involving fuel advisories or emergencies. This data enables operators to analyse and improve fuel planning and management procedures. 

In addition, Part 135 MOS section 7.06 required that operators must also ensure that the exposition outlines clear procedures for pilots to follow in the event of a low-fuel situation, including:

• a minimum fuel state
• emergency fuel situation.

Finally, operators should regularly review and update their operational manuals to reflect lessons learned from safety reports and audits, ensuring continuous improvement in fuel management practices.

Operator requirements for training, experience and consolidation on new aircraft types

Induction and minimum qualifications

The operator’s operations manual stated that recruited pilots were to meet the following minimum requirements:

• commercial pilot licence with no medical restrictions[13]
• current Australian medical certificate
• pass of a pre-employment check flight with the HOFO or a delegate.

Once inducted, a new pilot would learn the routes with existing pilots before being checked to line by the HOFO. 

The operator’s operations manual stipulated 5 minimum requirements for a pilot in command of the C310 (Table 6).

Table 6: Operator’s 5 minimum requirements for operating the C310

The HOFO was required to conduct a check-to-line flight and, if successful, the pilot would be cleared to conduct air transport operations as pilot in command on the new type. The substantive HOFO stated that generally it would be expected that multiple ICUS flights would occur with either the HOFO or a supervisory pilot before a check-to-line would be conducted. The CEO reported that generally 15–20 hours on type would be sufficient to conduct line operations as pilot in command. 

During the draft review process, the CEO reported that the calibre of pilots coming through from flight schools was lower than previously experienced, noting that a lot of the organisation’s time was spent getting pilots up to commercial standard.

After completing the check-to-line flight, the pilot of the accident flight had accrued a total flying time of 740.5 hours. The operator received an exemption from the operator’s insurer for the pilot to undertake air transport operations in the C310 without meeting the specified minimum requirement of 750 hours. 

Under CASR 61.650, pilots were required to have completed an IPC in the previous 12 months to fly a multi-engine aircraft under the IFR. The IPC must also be done in a multi-engine aircraft of the same category. The substantive HOFO noted that, once a pilot was checked to line, there was no follow up or specific oversight on their operating capabilities until their next proficiency check in 12 months, in line with the CASR requirements and the operations manual, which stated:

If flying under the IFR, pilots are required to conduct an Instrument Proficiency Check with an authorised Flight Examiner prior to one (1) year from the last day of the month in which it was issued (IFR operations).

There were no specific regulatory requirements for Broome Aviation to provide additional consolidation flights for pilots transitioning to the C310 as, at the time of the accident, the operator was operating under CASA exemption 87/21.[14] 

In December 2021, Civil Aviation Safety Regulation (CASR) Part 135 (Australian air transport operations – smaller aeroplanes) commenced. It introduced more stringent requirements for flight crew training and checking for operators conducting air transport operations. However, operators could operate under the exemption that applied to a significant proportion of the previous small charter sector. This meant the operator was not required to conduct line training, a check-to-line, or complete proficiency checks, other than to ensure those proficiency checks and flight reviews mandated by Part 61 of CASR were carried out on their flight crew members.

Supervisory pilots

The CASA‑AMC/GM Part 119 - Australian air transport operators - certification and management v 2.3 noted that some operators have diverse fleets and there are scenarios where the HOFO may not be qualified on every aircraft type or in every role/function performed under its air operator’s certificate (AOC). In this case, operators can elect to use a structure where another pilot is identified to complete that position. In the case of Broome Aviation, the substantive HOFO conducted the check and training for the C210, in addition to nominated supervisory pilots, but for the MEA this position was covered by supervisory pilots. The operator required that supervisory pilots had:

• a minimum of 20 hours total time on type
• completed training with the HOFO or nominated person (with such training including the use of the line training and check forms)
• met the relevant recency or proficiency requirements to act as pilot in command
• been nominated, in writing, by the operator to be supervisory pilot and recorded as a named supervisory pilot.

The operator’s supervisory pilot register had not been updated since 1 December 2021. The register contained the name of one pilot who had been approved to conduct supervisory flights for the C310, however this pilot left the operator while the substantive HOFO was on leave. A second pilot had been listed as a supervisory pilot for the C210. The substantive HOFO stated that the second pilot had been assessed to conduct supervisory flights for the C310, however the register had not been updated to include this information. This pilot (detailed below as ‘Pilot 1’) also left the operator while the substantive HOFO was on leave.

During the period between December 2022 and June 2023, 7 pilots flew the operator’s C310, including one who had completed the training but had not been checked to line. Multiple pilots stated that training and guidance on the C310 during this period was limited. Of the 7 pilots:

• Pilot 1 – was a senior pilot for the operator who was signed off as a supervisory pilot for the C310. They conducted the check-to-line for Pilot 2. Pilot 1 left the operator at the end of December 2022 and returned for 3 weeks at the end of February 2023.
• Pilot 2 – completed no ICUS flights prior to completing a check-to-line flight in November 2022 that lasted 1.1 hours. The pilot was not formally signed off as a supervisory pilot on the C310, although they had extensive instructional time on MEA, prior to assisting with ICUS flights. The pilot left the operator at the end of February 2023.
• Pilot 3 – completed 2 ICUS flights, one with the interim HOFO (3.7 hours) and 1 with Pilot 2 (1.6 hours), before completing a check-to-line (1.5 hours) with the interim HOFO a week later in February 2023. The pilot left the operator at the end of March 2023.
• Pilot 4 (pilot of the accident flight) – completed 1 ICUS flight with Pilot 2 and 4 IPC flights with the external instructor on the aircraft. They were subsequently checked to line in April 2023, 130 days after their last flight in the aircraft, by the interim HOFO.
• Pilot 5 – completed 3 IPC flights with the external instructor and completed no ICUS flights. They were checked to line in May 2023, 162 days after their last flight in the aircraft, by the interim HOFO.
• Pilot 6 – completed 3 IPC flights with the external instructor and had not completed any ICUS flights since.
• Pilot 7 (interim HOFO) – completed their check-to-line with Pilot 1 (3.6 hours) in December 2022 and completed 1 IPC flight with the external instructor.

At the time of their check-to-line, multiple pilots who conducted C310 operations for the operator during the period from November 2022 to June 2023, did not meet the operator’s minimum requirements 1, 2 and 3 detailed in Table 7. All pilots met requirements 4 and 5. The pilot of the accident flight and Pilot 5 both had limited experience flying MEA (under 50 hours), having not flown another MEA type outside of flight training. 

Table 7: Compliance with operator’s minimum requirements on the C310 at the time of check-to-line

Pilot 1 was excluded as their check-to-line was completed prior to November 2022. Pilot 6 was excluded as they had not completed a check-to-line for the operator.

Multiple pilots reported that they had limited training on the C310 and anticipated completing additional ICUS flights before being checked to line. Three pilots assessed that they were tasked with operating the aircraft without adequate training on the fuel system. They expressed concerns about the limited training noting the C310 had a complex fuel system. Multiple pilots reported learning the systems while conducting operational flights.

Emergency procedures

The POH included emergency procedures for inflight engine failure, which included a requirement to check:

• fuel flow rate
• fuel selector positions
• fuel quantity. 

After the second surging event on the right engine, the pilot crossfed the left main tank to the right engine and referred to the quick reference handbook. This handbook outlined the ‘engine failure during flight’ checklist. The pilot stated that they referred to the checklist to determine whether any actions could be taken to address the surging, noting that the engine had not completely failed. There was no checklist to address engine surging. 

At this point in the flight, the aircraft was located between 2 nearby diversion airstrips of Kimberley Downs Station, located approximately 5 NM to the south‑east, and Meda Station located approximately 16 NM west (Figure 15). The pilot noted they were familiar with the location of the airstrips, however they had never operated from them and were unaware on their suitability and condition. The pilot stated that because of these unknowns that they believed the only suitable airstrip was Derby Airport. 

Figure 15: Diversion locations

The pilot did not consider diverting to RAAF Base Curtin. Source: Google Earth, annotated by the ATSB

The flight data indicated that the pilot initiated their descent from 10,000 ft at the normal top of descent position, while continuing to track towards Derby Airport, at an average descent rate of 400 ft/min. Approximately 3 minutes into this descent, the pilot crossfed the right engine from the left main tank. 

Engine surging

When surging occurred in both engines, the pilot noted that it appeared to be from fuel starvation. The aircraft manufacturer noted that in the event of simultaneous engine power losses or surging, the engine ’Airstart’ checklist could be actioned twice, as only one engine should be restarted at a time. Additionally, the ‘FORCED LANDINGS (Complete Power Loss)’ checklist should be used if pilots were unable to regain power. 

The pilot continued tracking to Derby Airport while switching fuel tanks, attempting to draw any remaining fuel. The manufacturer noted that the certification rule, at the time of the aircraft’s certification, required multi-engine aircraft to regain full power and fuel pressure within 20 seconds after switching from an empty tank to a full tank in level flight. The aircraft tracking data indicated that at an altitude of approximately 4,500 ft the descent rate increased to 1,500 ft/min. The aircraft travelled approximately a further 5.5 NM over approximately 3 minutes before a forced landing was conducted (Figure 16). 

Figure 16: Aircraft altitude variation with distance to Derby Airport 

4. Right engine surge – crossfeed right engine off left main tank; 5. Inbound call for Derby Airport; 6. Dual engine surge; 7. Mayday call; 8. Accident site. Source: ATSB

When the pilot determined they would be conducting a forced landing, they declared a MAYDAY to ATC. The aircraft was at an altitude of approximately 700 ft. The pilot later advised they had insufficient time to complete any checklist items after the MAYDAY call, however they lowered the landing gear as they were aiming to land on the Derby Highway as it was assessed as the best available option. There were approximately 30 seconds between the MAYDAY transmission and the forced landing.

Survivability

Safety briefing

The operator had a safety briefing video for the C310. The video outlined the:

• use of:
  • doors
  • seatbelts
  • emergency exits
• location of:
  • life vests
  • safety briefing card
  • emergency supplies
  • installed emergency locator transmitter (ELT)

The pilot noted there were 2 main differences between the aircraft and the information in the video. The location of the emergency supplies was in the nose of the aircraft rather than the wing cargo locker, and the ELT was portable rather than installed (see the section below titled Emergency locator transmitter).

This was the second time the passenger had flown in VH-DAW with the pilot. The passenger noted that on the first time flying in the aircraft they were shown a safety briefing video. On this occasion they were not shown the video and instead were given a briefing while at the aircraft. They recalled the briefing outlined the information regarding the emergency exits and seatbelts, noting there were other topics covered that they could not recall. The passenger recalled that they did not read the safety card while in the aircraft as they flew frequently. The safety card contained information on how to adopt the brace position.

When the passenger was asked to brace by the pilot, they stated they were unsure how to brace properly in the aircraft and reverted to their knowledge of the brace position for larger commercial aircraft. 

Seatbelts and upper torso restraints

The pilot seat was fitted with a lap belt and upper torso restraint (UTR),[15] consistent with the regulatory requirements. The pilot stated that they would not wear the UTR portion of the harness during cruise as it limited their ability to view the gauges on the opposite side of the cockpit. The UTR was only worn during take-off and landing. The pilot stated that during the emergency, they did not put on the UTR. The pilot sustained severe facial injuries and a loss of consciousness when the aircraft collided with terrain.

The passenger’s seat was fitted with a lap belt. This was worn by the passenger during the emergency and forced landing. The passenger received minor injuries, including bruising around the abdomen due to the lap belt.

Emergency locator transmitter

The aircraft was fitted with a portable emergency locator transmitter (ELT).[16] The pilot recalled that on first flying the aircraft they had checked the expiry date of the ELT and noted it was out of date. The portable ELT was subsequently replaced prior to the aircraft’s next flight. 

The safety briefing video showed an automatic installed ELT[17] within the aircraft. The pilot noted that during pre-flight briefing with the passenger they explained the location of the ELT was different to the safety briefing video, however they did not explain the process to activate it. 

The CASR Part 135 MOS required aircraft that were flown more than 50 NM from the departure aerodrome to carry an automatic ELT. However, this requirement was not applicable to the aircraft until 2 December 2023. Prior to then, the aircraft was operating under regulation 252A of the Civil Aviation Regulations, and subsection 6 of Civil Aviation Order 20.11, which permitted either a portable ELT or an installed ELT in the aircraft.

Due to the pilot being rendered unconscious during the accident sequence, the portable ELT was not activated. The passenger contacted emergency services while still in the aircraft using their phone, identifying the accident location from a passerby who stopped to help. 

Operator and management information

Overview

Broome Aviation was re-issued an air operator’s certificate (AOC) on 11 November 2022, to conduct operations under CASR Part 135 ‑ Australian air transport operations – smaller aeroplanes, allowing single and multi-engine piston and single engine turbine air transport operations. At the time of the accident, it operated the following Cessna aircraft:

• 7 x C210 (single-engine piston)
• 1 x C310 (multi-engine piston)
• 1 x C404 (multi-engine piston)
• 1 x C208 (single-engine turbine).

In addition to a head of flying operations (HOFO), the operator had 7 seasonal pilots in a combination of full-time and casual positions.

Figure 17: Operator’s organisational structure

Source: Broome Aviation

Chief executive officer

The CEO held the positions of flight operations manager[18] and head of maintenance control (HAMC) (Figure 15).[19] They also owned and operated Broome Air Maintenance (BAM). This maintenance facility performed all the maintenance on the Broome Aviation fleet. The facility’s personnel comprised a chief engineer, who was registered as a licenced aircraft maintenance engineer (LAME), and aircraft maintenance engineers (AMEs). The chief engineer began working at BAM in October 2022. 

The interim HOFO stated that the CEO had a hands-on approach to the organisation, stating that the CEO would generally create the roster for the pilots, which the interim HOFO would check and approve. The chief engineer stated the CEO would also be the final authority of any maintenance conducted on an aircraft. 

The Broome Aviation operations and maintenance manuals contained contradictory information relating to the person nominated in the HAMC position. In the operations manual, the chief engineer of BAM was incorrectly listed as the HAMC, whereas the maintenance manual accurately listed the CEO in the position. The CEO later stated that the chief engineer of BAM was filling a dual role of both chief engineer and HAMC, however this was not communicated to CASA and was not the understanding of the chief engineer.

Head of flying operations

During the period from December 2022 to June 2023, the HOFO position underwent a temporary change. The substantive HOFO took a period of leave, during which a new person assumed the position on an interim basis.[20]

The interim HOFO was employed as a full-time, permanent pilot for another operator (operator 2), which was also based in Broome and only conducted operations in Cessna 208 aircraft. Operator 2 was independent of Broome Aviation. The interim HOFO began to work with Broome Aviation in November 2021 as a casual pilot during operator 2’s off season. They recommenced casual work with Broome Aviation on 13 November 2022, again during operator 2’s off season. 

In late November, Broome Aviation asked them if they were willing to fill the position of HOFO to cover the leave period of the substantive HOFO. Having agreed, their application was submitted to CASA on 25 November 2022 (see the section titled Head of flying operations assessment).

The interim HOFO was assessed for the HOFO position by CASA on 7 December 2022 and subsequently approved for that position on 12 December 2022. On the same day, a handover was completed with the substantive HOFO. CASA was informed that the handover had been completed. The interim HOFO was also assessed by CASA (18 November 2022) and approved for the position of ‘alternate’ HOFO with operator 2 in January 2023 (see the section titled Requirements for an alternate HOFO).

At the time of their appointment to the Broome Aviation HOFO position, the interim HOFO held a commercial pilot licence (aeroplane), issued in early 2008, with single and multi-engine aircraft (MEA) class ratings. They had a total flying experience of 5,049 hours, of which approximately 135 hours were on MEA (Table 8). They had flown the C310 once prior to their HOFO assessment, which was a check-to-line flight in VH-DAW on 3 December 2022.

Table 8: Interim HOFO flight hours prior to assessment

The interim HOFO completed an IPC for MEA, in a different aircraft type, on 2 December 2021. It was renewed in the C310 during the external instructor visit to the operator in December 2022. Prior to conducting supervisory or check flights with Broome Aviation pilots, the interim HOFO had gained 20 hours flight time on the C310. This met the operator’s minimum requirements for supervisory pilots. 

Table 9: Interim HOFO Cessna 310 flight hours

The interim HOFO stated that they expected to occupy the position until the end of February 2023, when they were to return to operator 2 and the substantive HOFO was expected to return from leave. This time period was agreed to by operator 2, with the understanding that all flight and duty times for either operator would be recorded in both operators’ systems to ensure flight and duty limits were not exceeded. The interim HOFO stated they were unaware they had been approved and appointed by CASA in the ‘HOFO’ position and assumed they were in the ‘alternate HOFO’ position for Broome Aviation. They advised they only became aware that they were the appointed HOFO during a CASA level 2 surveillance activity (see the section titled Level 2 surveillance – 20 June 2023). 

Oversight of operations

Although the assessment CASA completed of the interim HOFO was for a period of one month, they did not contact the operator at the end of this period to consider if the assessment was still appropriate.

At the end of February 2023, the interim HOFO was told that the substantive HOFO’s return would be delayed until the end of June 2023. They advised that they discussed remaining as acting HOFO with the Broome Aviation CEO, however their duties would need to be reduced. These duties were subsequently reduced to check and training, confirmation of rosters (arranged by the CEO), and general availability for pilots requiring assistance. CASA was not informed of this change. The interim HOFO stated that their main responsibility after this time was with operator 2. 

At the beginning of March 2023, the interim HOFO completed a 2-week flight instructor rating course for MEA in Darwin, which was funded by operator 2. Following its completion, the interim HOFO then recommenced full-time work with operator 2. They stated that they were still contactable for any pilots at Broome Aviation who needed assistance and noted that 2 ‘senior’ pilots were available during this time (one of these pilots being the pilot of the accident flight). 

In March 2023, the management of operator 2 identified that the interim HOFO was still conducting flights for Broome Aviation. In response, they were advised to cease working for Broome Aviation as that work would affect their flight and duty times as they were also in the alternate HOFO position for operator 2. Operator 2’s management was unaware that the interim HOFO continued to conduct flights and remained the HOFO for Broome Aviation after the discussion in March 2023. 

While at Broome Aviation, the interim HOFO checked 3 pilots to line on the C310. The interim HOFO had accumulated 23.1 hours on the C310 prior to conducting the check-to-line flight on the pilot of the accident flight. They recalled that, even though they had recently received their instructor rating for MEA at that time, they did not feel comfortable simulating single engine emergencies. 

The interim HOFO stated that, after the pilot of the accident flight was checked-to-line, they followed up with them after their first couple of flights. The interim HOFO expressed no concern about the pilot’s operation of the C310 and noted the pilot had not contacted them in relation to issues or questions about the aircraft. The accident pilot confirmed they never contacted the interim HOFO regarding the C310, noting: 

I didn’t feel comfortable contacting the HOFO with 310 questions … this was due to their very minimal type knowledge and support within the entire company, so I sought advice from outside the company from more experienced pilots on the 310.

During the 4-month period from March to June 2023, the interim HOFO recorded 33.85 duty hours at Broome Aviation, however they noted that they would often ‘drop in’ after completing flights for operator 2 and did not formally record all the time spent at Broome Aviation. The CEO later advised that the HOFO was available in the afternoons for discussions with pilots however, none of the pilots made use of that opportunity. Comparatively, the interim HOFO recorded 458 duty hours at operator 2 during this period and reported they flew full‑time for the operator, while also conducting check and training for its pilots. 

At the time of the accident, the interim HOFO had been in the HOFO position for Broome Aviation for 7 months. A week after the accident flight, the substantive HOFO returned to the operator.

Pilots flying for Broome Aviation stated that, when contacting the interim HOFO between March and June 2023 they would not get an immediate response, noting that the HOFO’s priority was flying for operator 2. The pilot of the accident flight stated that they would generally reach out to another pilot (who had recently left Broome Aviation) for guidance on the C310 rather than the interim HOFO.

Multiple pilots reported that the CEO would monitor each flight using the operator’s online tracking system. If any deviations in flight time or route occurred, the pilot would receive a ‘barrage’ of foul language, be accused of not considering the monetary implications for the organisation, and then face threats of loss of flight hours or potential termination of employment. By contrast, the CEO stated they had little interaction with the pilots as their office was located at the maintenance facility, which was on the opposite side of the airport. They also stated that all communications about aircraft maintenance would be directly from the HOFO. 

The interim HOFO reported that, after completing a day’s duties at operator 2, they would pass through Broome Aviation to check the operations for the day. They recalled they would have general conversations with pilots and considered them to be close friends as well as work colleagues. However, the pilots the ATSB spoke to stated that, during this period, they received little to no guidance on flight operations (for all aircraft types). 

The substantive HOFO stated that they primarily spent the workday in their office and generally interacted with pilots while they were completing paperwork. Most interactions involving questions or issues occurred over the phone. They also reported that the CEO, whose office was located at the hangar, had more frequent face-to-face interactions with the pilots, often seeing them before and after their flights.

Safety management system 

CASR Part 119 (119.190), which commenced on 2 December 2021, included a requirement for an operator conducting operations under CASR Part 135 (Australian air transport operations – smaller aeroplanes) to have a safety management system (SMS). However, at the time of the accident the operator was operating under exemption EX87/21 and was not required to have met the SMS requirement. This exemption applied to a significant proportion of the small charter sector and was not specific to this operator. Despite that, Broome Aviation was required to have completed an SMS implementation plan and submitted the plan to CASA by 4 April 2023. The operator had not completed that process at the time of the accident.

The operator’s nominated safety officer was a line pilot. They left the operator at the end of December 2022 and returned to complete a short 3-week stint at the end of February 2023. The operator did not nominate a new safety officer after this pilot left the organisation and they were not required to do so, as there was no regulatory requirement for them to have one.

While not required, the operator did not have a formal incident or hazard reporting system, or a means of identifying the development of hazardous trends. Interviews with various staff members indicated that, although there were safety meetings involving pilots to identify safety risks, these meetings had not been held since the arrival of the interim HOFO.

Organisational pressures

The ATSB interviewed the 5 pilots who conducted Cessna 310 operations for the operator during the period November 2022 to June 2023, as well as 2 other pilots. During interviews, most of these pilots revealed events in which they were reprimanded or challenged by the CEO, or they witnessed similar treatment to other pilots, for declining a flight due to a maintenance concern. Many pilots stated they had experienced pressure from the CEO to complete flights with aircraft they considered unairworthy. 

They stated they were worried about the consequences, such as employment termination or the hindering of their career progression, if they did not complete those flights. Pilots also stated that they felt pressure to ‘get the job done’, with one pilot stating: 

…it was always like you just have to do the job. You have to do the job. It's not anything to do with safety or if you have the training for it either…

During the draft report review process, the CEO acknowledged that at times they had reprimanded and challenged pilots. However, they stated that this was in response to pilot actions that they considered imposed unnecessary financial and/or reputational cost on the company.

Complaints received by CASA from pilots and a passenger (see the section titled Complaints to CASA) stated multiple concerns for the safe operation of aircraft. One complaint by a former pilot stated:

… operational pressure from the organisation and their management is forcing pilots to make unsafe decisions in flight. A report to CASA is better than trying to reason with the company. The mentality of not only managers but also the owner isn't conducive to safe aviation practices.

Senior management stated they were unaware of any instances where pilots were reprimanded for not flying an aircraft considered to be unserviceable. All stated that, if there was a defect with an aircraft, the operator’s stance would be to get it rectified before another flight was completed.  

During interviews, former pilots expressed concerns for the operator’s future, and one stated: 

I knew that either I was going to be involved in something that I shouldn't be or that an incident was going to happen. 

Most of the pilots the ATSB spoke to who had left the organisation stated their decision to leave was based on aircraft maintenance issues and/or the unacceptable treatment they received as pilots from senior management.

Civil Aviation Safety Authority oversight 

Head of flying operations assessment

Position requirements

Under the CASRs, the HOFO must meet specific requirements, including holding appropriate qualifications, demonstrating substantial operational experience, and having a thorough understanding of regulatory obligations. The HOFO is responsible for overseeing operational standards, managing safety and compliance frameworks, providing leadership to flight crews, and ensuring that all activities align with organisational and regulatory expectations.

Specifically, CASR sub regulation 119.140(1) stated that: 

The head of flying operations of an Australian air transport operator must safely manage the flying operations of the operator.

CASR 119.135 required the HOFO to:

• hold a pilot type or class rating for a type or class of aircraft that is used to conduct a significant proportion of the operator’s air transport operations

• have at least 500 hours flight time on a type of aeroplane that is the same as, or substantially similar to the type of aeroplane used to conduct a significant proportion of the operator’s Australian air transport operations

• have at least 6 months experience in the conduct or management of air operations conducted under an AOC or equivalent foreign authorisation.

CASA’s acceptable means of compliance and guidance material (AMC/GM) Part 119 - Australian air transport operators - certification and management v 2.3 outlined recommended minimum hours and experience for a HOFO based on the size and complexity of the operator. For an operator with more than one MEA, such as Broome Aviation, CASA recommended that a HOFO have a minimum of:

• 1,000 hours total flight time

• 200 hours in command of MEA. 

Requirements for an alternate HOFO

Under CASR 119.205, there was a requirement for the operator’s exposition to list the qualifications, responsibilities, and names of key personnel. There was also a requirement to list the names of each person authorised to carry out the responsibilities of the position when the substantive position holder was absent from the position or unable to carry out their responsibilities. These authorised persons were referred to as alternate key personnel. 

If an operator wanted to change the specific individual in the alternate key position, CASA approval was required, due to this being considered a significant change. Once approved, this should lead to the insertion of the nominated person into the operator's exposition as an alternate key position holder. Operators working under CASA exemption EX82/21, including Broome Aviation, were not required to name alternate key personnel in the exposition, even if they had an alternate.

The AMC stated that small operators with limited personnel may nominate alternate HOFOs employed by another operator, provided they detailed in their exposition how the alternate HOFO would perform the position effectively. The requirements for an alternate HOFO were the same as the HOFO position. In addition, the alternate HOFO had to have a direct relationship with the operator and sufficient capacity to fulfill their duties. It also stated that dual responsibilities for multiple operators were unlikely to meet this standard. 

The operator’s operations manual stated that an alternative HOFO must be approved by CASA. It also stated that:

• a handover form must be completed prior to the transfer of the responsibilities from the HOFO to the alternate HOFO

• the alternate HOFO could not be the acting HOFO of any other operation while acting as the HOFO for Broome Aviation

• the alternative HOFO could only perform the duties of the HOFO during the specified period they had been nominated to act as HOFO

• CASA be informed within 7 days of the transfer being completed. 

Assessment process

CASA’s HOFO suitability assessment was a formal process designed to evaluate a candidate’s suitability for the position of HOFO in a CASR Part 135 operator. It aimed to ensure the individual had the necessary qualifications, operational experience, and management skills to oversee flight operations safely and in compliance with CASA regulations. The assessment begins with a review of the candidate’s documentation, including licences, flight experience, and familiarity with the operator’s aircraft and procedures. CASA also examined the candidate’s knowledge of relevant regulations, operational procedures, and safety management principles.

The assessment included an interview where CASA evaluated the candidate’s understanding of key areas such as CASA regulations (Parts 135, 91, and 119), the operator’s exposition and procedures, SMS implementation, and human factors. The candidate was also required to demonstrate the ability to manage compliance, oversee pilot performance, and respond effectively to safety-critical situations. Leadership and decision-making skills were also a focus, as the HOFO must manage teams, promote a strong safety culture, and ensure the organisation adheres to all operational requirements.

The assessment may have also required a practical demonstration of the candidate’s ability to implement operational procedures and manage risk. Based on the assessment, CASA determined whether the candidate was fit for the position or if further experience was needed.

Applicant 1

In October 2022, the operator submitted an application to CASA for its HOFO position, replacing the substantive HOFO as they advised they were resigning from the key personnel position of HOFO for medical reasons on 17 October. It also submitted a change to its operations manual to replace the substantive HOFO with the proposed HOFO candidate. This applicant had 2,327 flight hours with 1,009 multi engine hours, however they did not have any air transport experience and had not been a HOFO with any other operator.

This application was assessed on 14 November 2022 and the CASA flight operations inspector (FOI) deemed the applicant unfit for the position due to:

• limited experience in air transport operations
• not meeting the 500-hour requirement on aircraft substantially similar to those primarily operated by the operator
• an assessment, based on previous dealings with the CEO, that an experienced HOFO was required to ensure pilots were managed professionally and the operation was safe and efficient.

On 21 November, CASA advised the operator that the applicant was unsuitable. In internal CASA correspondence, the FOI noted that the application was to replace the substantive HOFO who would be on leave and would be returning at the end of April 2023. The FOI stated concern for continuity of the operation over this period. 

The substantive HOFO continued in the role in a limited capacity. 

Applicant 2

On 19 July 2022, operator 2 applied to CASA for approval of an alternate HOFO position, with the applicant who was later approved to be Broome Aviation’s interim HOFO being the nominated candidate (Table 10). This application was assessed by the same FOI mentioned in the section above on 18 November 2022. When requested, CASA could not locate the assessment form completed on applicant 2 for this position. The FOI later stated that they had expected to complete a flight test for the interim HOFO during this original assessment, however an internal CASA decision was made that it would be a desktop assessment only.

Following the rejection of its first applicant, Broome Aviation submitted an application for an alternate HOFO position on 25 November 2022, with the interim HOFO being the nominated candidate and an expectation that this person would be acting in the HOFO position for a limited period. This application included changes to the operations manual to update the positions. The same FOI completed this assessment and stated that, because they had recently assessed the applicant as an alternate HOFO for operator 2, the process could be expedited as many of the assessment elements had previously been covered. 

The assessment for the interim HOFO for Broome Aviation was completed by the FOI on 7 December 2022. The documentation stated that the assessment was for an ‘alternate’ HOFO position, with a time limitation of 1 month. It was also noted that the applicant had taken leave from their original operator to fulfill this position.  

The FOI advised that the 1-month timeframe was due to their understanding that the substantive HOFO would be travelling overseas for this time and would be returning to the operator. However, there was also email evidence indicating that the FOI knew the substantive HOFO would be on leave until April 2023. In discussions with the ATSB, the FOI stated the 1‑month period was the primary timeframe considered for this applicant and as a result they were not assessed in their:

• check and training experience
• MEA experience
• ability to conduct oversight, if working for 2 operators.

On 12 December, CASA formally issued the approval for the applicant to become the HOFO rather than as requested and stated in their own paperwork, the alternate HOFO for Broome Aviation. The updated operations manual specified the applicant was appointed in the alternate HOFO position, instead of the CASA‑approved position of HOFO. It did not change the nominated person for the HOFO position, even though they were on leave for a significant time. There was no explanation in the operations manual of how the alternate HOFO would manage this position if they returned to their original operator. The manual amendment was accepted by CASA. The FOI advised that the operations manual was accepted as the change was for a short time and they did not expect the operator to resubmit the manual when the substantive HOFO returned.

Table 10: HOFO assessment timeline

CASA stated that a key personnel position did not come with a time limitation, although one could be imposed by the operator and outlined in its exposition.[21] If this was the case, CASA would note the time limitation on its assessment of the applicant and place a note on file in the CASA system. While CASA’s assessment of the interim HOFO was based on a 1-month period, no note was placed on file.  

In February 2023, while preparing for a level 2 surveillance activity, a regulatory oversight flight operations inspector (RO FOI) identified that the interim HOFO had been assessed for the position on the basis of performing that position for one month, however they were still acting in this position 3 months after the assessment had been completed.

The RO FOI contacted the interim HOFO to discuss the situation and was advised that the substantive HOFO would be on leave until June 2023 and the interim HOFO had been conducting HOFO duties. They also were advised that the interim HOFO would be recommencing seasonal work with operator 2 at the beginning of March 2023, with the intention of continuing with Broome Aviation as HOFO on a ‘remote basis’. The RO FOI ensured the interim HOFO was aware of their own requirements for fatigue management, discharge of responsibilities and general oversight of Broome Aviation activities while working with the other operator. 

The RO FOI noted that, although there was nothing legislatively preventing this arrangement under CASR Part 119, it was unorthodox and created a level of concern. There was no reassessment of the interim HOFO in relation to their duties, as the RO FOI assumed a full assessment had been completed during the other FOI’s previous assessment in December 2022. 

Complaints to CASA

The CASA Surveillance Manual 15.1 required that when CASA received a complaint about an operator, it be classified as a class A–C occurrence and action be taken if it was assessed as class A or B (Table 11). A class A assessment required instigation of a level 2 unscheduled investigation, while a class B assessment could be investigated or added as an item in an upcoming surveillance.   

Table 11: CASA complaint occurrence classes and follow‑up action

In November 2022, CASA received a complaint about Broome Aviation relating to operational issues. The complainant stated that: 

there was an oppressive culture at the organisation, based on bullying and pressure from the CEO that ‘preys on junior pilots’. 

It also detailed instances of:

• pilots being forced to fly aircraft at night with unserviceable instruments
• pilots being advised to fly outside legal operational requirements
• comments made to pilots to ignore issues or defects with aircraft. 

This information was passed to the CASA surveillance team, where the RO FOI followed up on the complaint by talking to the complainant in February 2023. Although evidence, including copies of text messages, was supplied to CASA, the RO FOI explained to the complainant the importance of reporting an incident (either via the company reporting system or the CASA confidential system), with specific details, at the time it occurred. They also outlined the legal obligations of a pilot in command to record aircraft defects correctly.

After discussing the matter with the complainant, the RO FOI assessed the complaint was either indicative of a ‘disgruntled’ former employee, or there was a cultural issue at the operator. The complaint was added to the scoping document for a June 2023 surveillance activity (see the section titled Level 2 surveillance – 20 June 2023), and assessed as a class B. 

There was no documentation outlining if the complaint was followed up after the audit. 

CASA stated that the complaint it received in November 2022 did not provide sufficient specific information to act upon. The supplied text messages were not considered to be fully contextualised, clear, or related to specific events where additional evidence could be sought. 

Following the accident on 20 June 2023, CASA received 2 more complaints. The first complaint was from a pilot who stated that there was operational pressure from management forcing pilots to make unsafe decisions in flight. The complainant stated that they had witnessed this firsthand. No specific examples were provided. The second complaint was from a passenger who stated that on a charter flight from Broome, the twin-engine aircraft experienced a technical fault, and the pilot was instructed by management to continue the flight.

The scope of these complaints was added to a level 1 audit scheduled to be completed in August 2023 (see the section titled Level 1 audit – August 2023). 

There was no indication in any of the CASA documentation that the complaints received were followed up during or after either surveillance event. 

CASA stated that complaints regarding the safety culture of an organisation that did not have a safety management system (SMS) were difficult to assess, and there was no guidance given to inspectors on what to specifically assess. As such, an assessment, if completed, would be subjective to the person completing it. An in-depth assessment of an organisation’s culture required people to be prepared to talk about specific events or actions to ensure the context of the situation was fully understood. 

Surveillance activities

A level 1 CASA audit was a detailed evaluation that assessed an aviation organisation's compliance with regulatory and safety standards. Such an audit encompassed various aspects of the organisation’s operations, including:

• the SMS
• operational control
• maintenance
• airworthiness
• training
• competency
• regulatory adherence.

It involved a sample of operational aspects, often including extensive documentation reviews, interviews, and inspections. It aimed to identify both systemic issues and specific non-compliance or safety concerns. Any findings from a level 1 audit required the organisation to implement corrective actions to enhance safety and ensure continuous compliance with aviation regulations. The audit was typically scheduled at regular intervals or when there was a significant change in the organisation’s operations, such as new certifications, major incidents, or regulatory changes. The last level 1 audit on Broome Aviation prior to the accident was conducted on 19 October 2018.

A level 2 CASA surveillance activity was a more focused evaluation conducted to examine specific areas of an organisation's operations. This type of surveillance was typically less comprehensive than a level 1 audit and entailed an examination of aspects such as operational procedures, training programs, or maintenance practices. This surveillance was often conducted in response to a specific incident, identified risks, previous audit findings, or as part of ongoing surveillance and monitoring efforts. The last level 2 surveillance activity on Broome Aviation prior to the accident was conducted on 19 August 2018.

Level 2 surveillance – 20 June 2023

At the beginning of March 2023, the CASA surveillance team approved a level 2 surveillance activity on the operator. This was initiated as a result of:

• the complaint received by CASA in November 2022 regarding allegations of operational pressures placed on flight crew by the CEO
• the process surrounding the assessment and appointment of a temporary HOFO while the substantive HOFO was on leave. 

The surveillance was scoped to cover both topics and involved a site visit conducted by the RO FOI on 14 June 2023, 6 days before the accident. The scoping did not outline how the complaint received by CASA would be assessed during the surveillance and the surveillance report was finalised on 11 July 2023.

During the surveillance, discussions were held with the interim HOFO regarding their position and level of oversight of operations, noting they were working full time for another operator at that stage. It was concluded that the interim HOFO was providing a level of oversight and interaction with personnel, and this was achieved via:

• regular discussions with crew
• oversight of schedules and flight and duty via the organisation’s systems
• conduct of company proficiency flights / line and remedial training with flight crew
• some limited formal governance meetings.

The surveillance report noted that no documentation could be supplied to demonstrate that both informal and formal meetings were being conducted during the interim HOFO’s time in the position. CASA issued a safety observation to Broome Aviation to review and update the content of its operations manual to include the governance processes utilised by the HOFO and establish a method and database to record such meetings and their outputs.

CASA reviewed the documentation surrounding the interim HOFO’s flight and duty times at both organisations and assessed that these complied with regulatory requirements.  

The RO FOI advised the ATSB that they had concerns about the level of oversight the interim HOFO was providing for Broome Aviation during the time they were concurrently employed as an alternate HOFO at another local operator. They noted the interim HOFO’s view of the position seemed to revolve around being there for a short time. This concern was not documented on the final audit report. 

The final surveillance report contained no mention of the November 2022 complaint and how it was assessed during the surveillance activity, and there was no other documentation to explain why the complaint was not mentioned in the report. The RO FOI stated that the complaint gave little information around the specifics of the incident, making it hard to check while at the operator. 

When asked if any of the pilots were interviewed regarding the topic of operational pressures, the FOI stated they witnessed pilots coming in and out of the office area while they were conducting the meeting with the interim HOFO and ‘everyone seemed happy’. They also recalled there was no indication there was anything out of the ordinary that would have made them want to talk to any of the pilots. The RO FOI stated that it was generally possible to find a way of talking to pilots during surveillance activities and they had done so on previous occasions (with other operators), but did not see the need to do so on this occasion. There was no indication the operator’s management was aware of the complaint at the time the audit was conducted.

CASA’s processes required that this surveillance report was submitted to the RO FOI’s manager for approval prior to the audit being finalised. The absence of any content about the complaint, one of the 2 reasons for the surveillance activity, was not addressed during the approval process.

Level 1 audit – August 2023

A level 1 audit on the operator was conducted in August 2023. The audit’s scope originally covered:

• airworthiness assurance
• data and documentation
• operational support systems
• safety assurance
• safety risk management.

It was subsequently expanded to include aspects associated with the apparent circumstances of the C310 accident, focusing on the fuel policy, flight planning, and training, and the 2 further complaints submitted to CASA on the operational pressures placed on flight crew. The audit team consisted of 3 inspectors, and included a site visit conducted on 28 August.

The audit found multiple issues with the operator’s operations manual. It noted that, although it met the basic requirements, it had not been updated in accordance with legislative changes. It also noted that the operations manual was not compliant with CASR Part 91/135 fuel and flight planning requirements. 

The audit also identified that there was a general weakness with regard to the content and detail of the operations manual, in particular the policy and procedure surrounding the induction, operational training and release to line of junior pilots. The RO FOI stated that, due to the operator sitting under exemption 87/21, the requirements for meeting a training and checking system were not in place at the time. This situation meant no safety finding could be issued regarding the weaknesses in training and checking.

The audit found that, although the operations manual had an extensive section relating to operational use of maintenance releases (MRs), some references were either no longer valid or current legislative references were missing. It also found that Broome Aviation was no longer following the process for monitoring MRs and MELs that it had outlined in its maintenance control manual (MCM). The MRs of aircraft current at the time were not reviewed during this audit. 

Previous level 1 audit

During the previous level 1 audit in October 2018, an airworthiness inspector noted various deficiencies with an aircraft during a ramp inspection. These deficiencies had not been entered into the MR or other aircraft documentation. The operator was given a list of these deficiencies in the surveillance report. No other aircraft or MRs were inspected during this event. 

After the FOI was informed about the deficiencies on the aircraft, they identified that pilots’ maintenance training was not being conducted in accordance with the MCM or the operations manual. CASA recommended the operator undertake an educational program to provide guidance for the pilots in the following areas:

• conducting accurate pre-flight inspections
• entering defects into maintenance releases
• checking for any potential items that could pose a risk to flight
• correct use of maintenance releases.

CASA confirmed that Broome Aviation completed this educational program with all pilots who were employed at the time.

Related occurrences

Numerous fuel management and fuel starvation incidents and accidents have previously been investigated by the ATSB, including:

• Engine power loss and forced landing involving Pilatus Britten-Norman Islander BN-2A VH‑WQA, Moa Island, Queensland on 3 October 2022 (AO-2022-046)
• Fuel starvation event involving Cessna 310, VH-JQK, near Sunshine Coast Airport, Queensland, on 18 August 2022 (AO-2022-040)
• Cessna C310R, VH-HCP, 3 km east of Newman Airport on 26 January 2001 (200100348)

The ATSB found that pilot understanding of, and management of aircraft fuel systems played a crucial role in these occurrences.

Safety analysis

Introduction

On the return leg of a flight from Turkey Creek to Derby, Western Australia, the pilot encountered dual engine surging. The pilot, assessing this was due to fuel starvation, began switching fuel tanks to utilise any remaining fuel. With no resolution, the pilot initiated a MAYDAY call to Brisbane Centre air traffic control, alerted the passenger to the emergency, and told them to brace for impact. During the subsequent forced landing, the right wing of the aircraft hit a tree causing the aircraft to turn 180⁰ and come to an abrupt stop on the edge of the highway.

The pilot sustained serious facial injuries, and the passenger sustained minor injuries. The aircraft was substantially damaged.  

This analysis firstly considers the pilot’s fuel management during both the first and second leg of the flight, the response to the emergency, and survivability aspects relating to the injuries of those onboard. It also discusses contextual factors that potentially influenced the pilot’s performance during this period.

The analysis then discusses several other safety factors identified during the investigation related to pilot training and consolidation, operator oversight, organisational aspects and regulatory oversight. These factors either contributed to the accident, or increased aviation safety risk more generally.

The safety factors are discussed under the following topics:

• management of fuel
• response to the emergency
• factors influencing pilot performance
• defect reporting
• legibility and accuracy of aircraft internal placards
• survival aspects
• operational pressures
• regulatory oversight.

Management of fuel

Pre-flight planning

Pre‑flight planning is vital to ensure there is sufficient fuel for all phases of the flight. This includes accounting for fuel required for taxi, take-off, climb, cruise, descent, landing and the required fuel reserves.

The pilot used the operator’s flight planning software to plan the flight, however they did not know how to input forecast winds and reported that they routinely planned using nil wind. The operator also provided a manual system that would have enabled the pilot to accurately plan the fuel requirements for the flight. A pilot in command is required to ensure the relevant meteorological forecasts are considered when determining the quantity of fuel required for a flight.

Taking into account the known environmental conditions and the aircraft’s fuel consumption, if the pilot had used the available wind data, the flight plan would have identified to the pilot that the planned flight from Broome to Turkey Creek and return to Derby with the required fixed reserve and contingency fuel could not be achieved without refuelling the aircraft en route.

Pilot perception of fuel available in the auxiliary tank 

The pilot conducted all their flights in the Cessna 310 (C310) with the assumption that the auxiliary tanks could not be used for longer than 45 minutes without the engines surging and so used the auxiliary tanks for 40 minutes. While it is likely that this behaviour was due to the reverse leak in the right auxiliary tank check valve, the ATSB was unable to conclusively determine if this was the reason for the engine surging reported by the pilot on the day of the accident.

As a result, the pilot had not intended to use all the usable fuel on board, reducing their actual endurance. However, this was not reflected during flight planning. 

Broome to Turkey Creek

On assessing the remaining fuel following arrival at Turkey Creek, the pilot reported that it was unevenly distributed, with the right auxiliary tank full and less than expected in the right main tank. The ATSB considered the following possibilities to account for this reported distribution:

• the pilot did not switch the right main tank to the right auxiliary fuel tank en route to Turkey Creek
• the fuel leaked from the main tank to the auxiliary fuel tank on the ground at Turkey Creek.

Testing of the right auxiliary tank check valve indicated that, although there was a leak through the tank vent outlet bleed return line check valve, it is unlikely this leak was large enough to have resulted in the 40 L discrepancy the pilot experienced on the day of the occurrence. In addition, it is very unlikely that the amount of fuel that leaked would have been equal to the amount of fuel which would have been used if the pilot had selected the auxiliary tank during this leg of the flight. As such it was assessed that it was more likely that the pilot did not select the auxiliary tank on the right side during the flight.

This resulted in the pilot having full fuel in the right auxiliary fuel tank at Turkey Creek and 40 L of fuel less in the right main tank than the pilot expected.

Upon returning to the aircraft and completing pre‑flight checks, the pilot did not visually confirm the right auxiliary tank was full. As the fuel gauges in the aircraft were known to be inaccurate, a visual inspection of the auxiliary tank would have verified if it was full.

Return flight leg

The pilot routinely flew the aircraft with the main tanks selected for 60 minutes after take-off on each leg of a flight, rather than the 90 minutes detailed in the pilot’s operating handbook (POH) for the larger tanks fitted to VH‑DAW. While the pilot advised this was how they simplified inflight fuel management, that practice increased the risk of fuel being vented overboard from the main tanks. 

When the pilot switched from the main tanks to the auxiliary tanks on the second leg of this flight, it is likely the right main tank had only approximately 4 L of fuel remaining, and the left main tank had approximately 44 L remaining.

The ATSB could not establish why the right engine reportedly surged when selected to the right auxiliary tank, as there should have been approximately 97 L of fuel in the tank, and the reported issue with the check valve occurred when the fuel level in the auxiliary tank was approximately half (60 L). 

When the pilot reselected the right main tank in response to the surging, the amount of fuel contained in the tank would have increased to approximately 12 L due to the fuel returned when using the auxiliary tank. After a further 10 minutes, the right engine again surged, this time most likely due to fuel starvation, resulting in pilot crossfeeding to the left main tank, which also had minimal fuel at that stage. 

Fuel calculations conducted by the ATSB determined that when the right engine was crossfed to also draw fuel from the left main tank there was approximately 34 L of fuel left in that tank. About 10 minutes later, the engines began surging as the fuel in the left main tank was reduced to approximately 9 L of useable fuel. While it could not be determined why that quantity was insufficient to maintain continuous power, supply issues associated with an inoperative transfer pump (due to the observed tripped circuit breaker) and/or debris and other contaminants in the bottom of the fuel tank were possibilities.

Continued operation with defective fuel gauges

Multiple pilots who flew the aircraft stated that the fuel gauges did not indicate the correct amount of fuel in both the main and auxiliary tanks. Multiple pilots recalled that the gauges would become more accurate as fuel was burnt, however images of the gauge after flights indicated there was a still a large disparity between the 2 sides. The reading for both the main tanks and the auxiliary tanks were determined to be significantly out of tolerance and did not show an accurate amount of fuel on board for most of the flight. 

Accurate fuel gauges are crucial in an aircraft to ensure precise monitoring of fuel levels throughout the flight, directly impacting safety and operational efficiency. They provide the pilot with real-time information about the quantity of usable fuel, allowing for informed decision-making during critical phases of flight, such as when a diversion is required or in an emergency. Although the pilot was aware that the fuel gauges were unreliable, they relied on the indicated readings at multiple points in the flight.

CASA guidance stated that an operator’s exposition should detail the maximum allowable discrepancy between the actual fuel on board (gauge / visual) and calculated (journey log) figure, noting that industry practice was a maximum of 3% variation. This percentage was not outlined in the operations manual, and the gauge defects were not recorded on the maintenance release. 

However, the ATSB assessed that the gauge display defect did not contribute to the accident as the pilot was able to assess the fuel quantities in the fuel tanks throughout the flight. 

Operator’s procedures for fuel management

Pre-flight

A review of Broome Aviation’s pre-flight planning software identified that it did not include the 47 L block (total) fuel margin required under the operator’s fuel policy. It did however have a fixed fuel flow rate for climb of 150 L/hr. Conversely, the documented fuel planning figures to be used for manual fuel calculations did not include a fuel flow rate to use for climb. Although the operator was unaware of where the 47 L requirement originated from, the ATSB assessed that the margin it provided would cover the additional fuel flow used during climb, despite not being originally intended for that purpose. 

Inflight

Broome Aviation’s operations manual required pilots to conduct an inflight fuel check when reaching cruise or if needing to divert. It did not contain guidance on:

• conducting fuel checks at regular time intervals
• assessing fuel burn rates
• verifying the remaining fuel relative to the reserves required for contingencies, alternate routing, and final reserve fuel
• the maximum allowable discrepancy between the actual fuel on board (gauge / visual) and calculated (journey log) figure.

This resulted in pilots using a variety of procedures. 

Under the Civil Aviation Safety Authority (CASA) Manual of Standards (MOS) 135 Part 7, operators are required to outline inflight fuel management procedures. CASA’s Advisory Circular (AC) 91-15 Guideline for aircraft fuel requirements stated that pilots should have 2 sources of fuel values to crosscheck the available fuel on board. While the operator’s pilots were using a time‑based approach to their fuel calculations in flight, they did not have a viable crosscheck as the fuel gauge was inaccurate. A crosscheck process mitigates the reliance on a single source of information and ensures that any fuel related issues, such as high burn rates or fuel system defects, are promptly detected and managed, reducing the risk of fuel exhaustion. 

Although Broome Aviation’s operations manual did not include a procedure for recording inflight fuel calculations, the pilot completed an inflight fuel record every time they switched tanks. When the right engine surged the second time and crossfeed to the left main tank was selected, the pilot correctly assessed the amount of fuel remaining in the left main tank. They did not however accurately assess the remaining flight duration to Derby and the associated fuel required to fly that distance, considering that the right engine would be returning fuel to the right main tank.

The operations manual also gave little guidance on decision-making frameworks to address fuel‑related issues during flight, nor did it outline clear protocol for pilots to follow in the event of a low-fuel situation, including notification to air traffic services. 

Post-flight

The operator’s post‑flight cross check methods could not be completed as there was no fuel totaliser on board the aircraft and the fuel gauges were inaccurate. As such, the remaining fuel at the end of the flight was based on the pilot’s fuel calculations or a visual check by the pilots, which was not required by the operator in the post‑flight process.

Consequently, an accurate record of the fuel remaining in the aircraft was not being documented for the next pilot, nor was it being accurately entered into the operator’s data recording software for fuel flow checks. The pilots were working around this issue by ensuring the fuel tanks were full prior to every flight. 

Response to the emergency

After crossfeeding the right engine to the left main fuel tank, the pilot was confident that the available fuel was sufficient to reach Derby. They did not consider diversion to an alternate airstrip as they were unfamiliar with the condition and suitability of the nearby airstrips. They also did not consider the option of changing the left engine fuel selection to the left auxiliary fuel tank. This would have increased the fuel available in the left tank via the extra fuel return. 

In addition, as the aircraft had passed the pilot’s planned top of descent, they initiated a 400 ft/minute descent reducing the available glide altitude. Maintaining the aircraft's potential energy (altitude) is crucial for extending an aircraft's range during an engine failure, providing more landing options and time to manage the emergency effectively.

Recognising the stress induced by an emergency, indecision during an engine power loss situation reduces the time available for a pilot to plan and conduct an effective forced landing. Delays caused by prolonged troubleshooting, uncertainty over the severity of the issue, or hesitation in selecting a course of action consumes valuable altitude.

Once both engines began surging, the pilot identified that the left main tank had been drained of fuel and began to switch tanks in an attempt to utilise any remaining fuel. This included attempting to gain fuel from the main tanks a second time. Although the aircraft’s certification stipulated that power must be restored to the engines within 20 seconds in level flight if fuel was depleted from a tank, this requirement applied to level flight conditions and not during a descent phase. In a descent, the restoration of power, potentially extended beyond the 20 second threshold due to gravitational effects and reduced pressure in the fuel system.

At this point, only the auxiliary tanks had enough fuel to sustain engine power, but these tanks did not have fuel pumps to supply fuel to the engines. Textron advised that if the engines remained operating and the auxiliary tanks had been selected, the fuel could have been drawn from these tanks via the engine‑driven fuel pumps. As detailed above, it could not be established why the engines did not continue to operate at that stage as a small quantity of usable fuel remained in the left main tank.

There were 3 minutes between the start of the engine surging and the pilot's MAYDAY transmission. In this timeframe, a pilot who was experienced on the C310 would have had sufficient time to shut down and secure both engines (including feathering the propellers) and establish a glide approach. However, the pilot had limited familiarity with the aircraft fuel system, limited practical emergency procedure training on the C310, and the fuel gauges were faulty. As such, it is likely they struggled to methodically cycle through the fuel tanks while monitoring for engine response under the pressure of an unfolding emergency. During this time, the pilot also opted to continue to track towards Derby Airport, which increased the distance to the highway landing site, and delayed making a MAYDAY broadcast. 

While acknowledging that if the pilot had been able to re‑supply the engine/s with fuel and restart at least one of them, they could have continued to Derby, the delay associated with the multiple tanks selections ultimately compromised the safety and control of the forced landing. 

Factors influencing pilot performance

A review of the pilot’s activity in the days leading up to the accident identified an early wake-up time and long duty day. However, there was insufficient evidence to conclude that the pilot was experiencing a level of fatigue known to affect performance prior to, or during, the flight. The ATSB examined in detail the potential effects of experience and consolidation of skills around fuel planning and fuel management on the development of the accident.

Pilot experience and consolidation on the Cessna 310

Acquiring new skills, such as learning to fly a new aircraft type, requires training and practice. As the amount of experience on the aircraft increases, generally a pilot’s proficiency will improve, and performing tasks will become more automated and require less attention or mental resources (Wickens and others 2015, Stothard and Nicholson 2001). Prolonged gaps when flying an aircraft type have been known to affect skills, such as familiarity with specific aircraft systems, aircraft handling, and emergency procedures. 

After completing their IPC on the C310 in December 2022, the pilot had a 130-day gap before their check-to-line flight in April 2023. This limited the opportunity for skill retention on the aircraft. 

In addition, as the interim HOFO did not conduct any flights with the pilot that involved the use of auxiliary fuel tanks, there was no opportunity for the HOFO to see that the pilot was limiting their use of fuel from the auxiliary tanks to 40 minutes and the implications this had for fuel planning. Similarly, there was no opportunity to observe that the pilot was only using the main tanks for 60 minutes on every departure. The pilot also only began flying the C310 operationally after the interim HOFO had returned to their original operator. While the interim HOFO recalled discussing the pilot’s first flights with them, the pilot advised they only discussed operation of the aircraft with a pilot who had left the organisation.

Operator continued oversight and guidance

Pilots at Broome Aviation reported that the interim HOFO was unavailable most of the time between March and June 2023 due to their second job. Although the interim HOFO advised that they were available for any calls and were at the operator’s premises every day informally, the overall impression of pilots was that they were learning on their own and that they received little to no guidance on the operation of the C310. 

In addition, the interim HOFO’s recorded flight and duty times indicated that, although they reported that they visited the operator often, there was limited available time to oversee the operation. CASA personnel noted they had concerns about this aspect, and stated they received limited evidence to prove appropriate oversight was being conducted. During a surveillance event conducted shortly after the accident, CASA issued a safety observation to the operator to update the contents of its operations manual to include governance processes to record interactions between the HOFO and the operator’s flight crew.

At the time of the accident, as the operator was operating under an exemption from some Civil Aviation Safety Regulations (CASR) Part 135 (Australian air transport operations – smaller aeroplanes) requirements, there were no specific regulatory requirements for them to provide additional consolidation flights for pilots transitioning to the C310. For many types of transitions, such as to a new single engine aircraft type, consolidation may not be necessary. However, when moving from single-engine to relatively complex multi-engine aircraft, a period of consolidation flights is an effective risk mitigator. 

The operator had limited processes in place to ensure pilots with low time and experience on the C310 had the opportunity to effectively consolidate their skills prior to (or after) being checked to line. The substantive HOFO stated that they expected pilots new to the C310 to have completed multiple ICUS flights prior to a check-to-line flight. However, coincident with the substantive HOFO being on leave, several senior pilots left the organisation and the interim HOFO returned to work for their original operator. In combination this left limited capacity to supervise pilots.

Pilots who flew the C310 for the operator between November 2022 and June 2023 reported receiving limited training on the aircraft prior to being checked to line, noting they had expected to have completed more ICUS flights. Of the 7 pilots the ATSB contacted regarding C310 operations, 2 pilots reported they received less than the 5 hours required by the operator to fly under VFR, prior to being checked to line. Most pilots were checked to line with less than 10 hours on type.  The pilot of the accident flight and one other casual pilot had limited MEA experience prior to being checked to line, having only flown one other MEA type, which was during their flight training.

Additionally, the interim HOFO had limited hours on MEA and the C310 prior to assuming the position at Broome Aviation. They accumulated a further 57 hours of MEA operation, including 23 hours on the C310, prior to checking the pilot of the accident flight to line. However, it is likely the interim HOFO’s limited experience on the aircraft type impacted the depth and accuracy of operational guidance provided to pilots during line checks, as well as the ongoing oversight of their flying performance.

Due to the relatively complex fuel system on the C310, pilots transitioning to the aircraft type require a thorough understanding of the system’s layout, managing fuel during normal and abnormal operations, and recognising potential problems. While this knowledge can be obtained via ground‑based study of the system, supervised practice helps ensure pilots develop the necessary skills and confidence to operate the system safely and effectively in all conditions. Most pilots who flew the C310 received little to no guidance on its fuel system.

Defect reporting

Recording defects on a maintenance release (MR) allows for the timely identification, assessment, and rectification of issues that could impact an aircraft’s performance or safety. This process ensures that maintenance personnel have a clear understanding of any outstanding defects requiring attention, thereby reducing the risk of oversight or miscommunication during maintenance activities. It also records important information for pilots operating the aircraft.

Furthermore, documenting defects on a MR creates an auditable maintenance history, which is essential for tracking repairs, modifications, and inspections over the lifecycle of the aircraft. This documentation is also a regulatory requirement, ensuring compliance with regulatory standards. 

There were aircraft defects that had not been recorded on the MR, including inaccurate fuel gauges and a partially‑unserviceable autopilot. Although the operator had a process for pilots to report defects, this had generally not been followed by the pilots. The pilots advised that they would often talk to individuals in the maintenance facility after a flight about any defects or issues they had noted. Through this process, straightforward defects would likely be rectified but nothing would be written on the MR. However, defects requiring longer maintenance time and multiple parts, they reported being advised by maintenance personnel that the operator would not pay for the defect to be rectified and so consequently were not reporting them. 

This situation meant that when the pilot of the accident flight encountered defects, such as the engine surging, they did not report the concern. Consequently, this reduced the likelihood that the interim HOFO would become aware of the issue and arrange for it to be resolved, or at least communicated to the company pilots.

Of the serviceability‑related issues raised by the pilots, the fuel gauges and the autopilot were assessed to have been inoperable at the time of the flight. The interim HOFO did not themselves report the gauge defects or encourage the pilots to do so.

Legibility and accuracy of aircraft internal placards

The fuel selector placards fitted to VH‑DAW were incorrectly labelled, with both placards indicating that the aircraft was fitted with the smaller auxiliary tanks. In addition, the placard stating that the main fuel tank should be used for 90 minutes after take-off was missing and some of the internal fuel-related placards within the cockpit of the aircraft were partially illegible. 

The ATSB determined that these issues likely did not contribute to the occurrence as the pilot was aware the aircraft had the larger auxiliary tanks, and the pilot did not notice the discrepancy between the size of the tanks and the placard. Despite that, in aircraft like the C310 with specific fuel usage requirements, fuel placarding plays a critical role in ensuring accurate operation of the fuel system.

Survival aspects

Upper torso restraints

A substantial body of research has demonstrated that wearing upper torso restraints (UTRs) in small aircraft significantly reduces the severity of injuries compared to wearing only a lap belt. In particular, UTRs reduce the risk of head, neck and upper body injuries, associated with the person’s upper body flailing forward. An NTSB study published in 2011 found that when wearing a lap belt only, a pilot was 49% more likely to receive a serious or fatal injury, compared to those wearing both the lap belt and UTR. 

The pilot of VH-DAW was not wearing the aircraft’s sash-type upper torso restraint (mounted above the pilot’s left shoulder) at the time of the accident. The pilot received significant injuries, when they impacted the dash of the C310. 

That injury outcome was consistent with the findings of previous ATSB investigations, which found that pilots or passengers in the front seats of small aeroplanes and helicopters have not always worn the available UTRs, exacerbating the severity of their injuries in many accidents (for example, ATSB investigations 199800442, 200605133, AO-2010-053, AO-2012-083, AO-2012-142, AO-2016-074, and AO-2022-027).

It is very likely that the severity of pilot’s head injuries would have been reduced if they had been wearing the available UTR.

Emergency locator transmitter

The CASR Part 135 Manual of Standards required aircraft that were flown more than 50 NM from the departure aerodrome to carry an automatic emergency locator beacon (ELT), however at the time of the accident there was an exemption for the aircraft to operate with a portable ELT.

A portable ELT requires manual activation during an emergency landing and on this occasion the pilot was rendered unconscious during the accident sequence and the passenger did not know the exact location of the portable ELT. Therefore it is very likely that if a forced landing of similar severity had occurred in a more remote location, notification of the accident to emergency services would have been significantly delayed. That in turn may have led to a more severe outcome for the aircraft’s occupants. 

Research conducted by the ATSB in 2013, A review of the effectiveness of emergency locator transmitters in aviation accidents identified that while automatic ELTs only activated in 40–60% of accidents in which their activation was expected, they were directly responsible for saving an average of 4 lives per year.

Operational pressures

An effective safety culture relies on open communication channels, where employees can report hazards or errors without fear of reprisal. In this case, pilots reported to the ATSB that they experienced pressure from individuals in senior management to avoid recording defects on the MR, particularly those that could lead to operational delays, and pressure to conduct flights with aircraft that they considered were unsafe for flight. The sample involved several pilots selected by the ATSB based on them performing similar roles to the pilot involved in this accident. All the information they provided was consistent with similar concerns also reported to CASA by other pilots, together with a related complaint from a passenger. 

The pressure the pilots reported experiencing led to them regularly flying aircraft with defects. With regards to the C310, pilots developed an understanding that it was normal and approved practice to conduct flights in an aircraft with inaccurate fuel gauges, an autopilot incapable of holding altitude and engines prone to surging. 

In addition, the pressure the pilots reported experiencing probably led to them being less likely to formally report defects or discuss them with senior management as they had developed an understanding that they would not be remedied.

Based on the available evidence, management personnel were not fully aware of all the aircraft defects that the pilots were managing. If the defects had been formally reported through the defect reporting process, it is more likely they would have been discussed and, if they could not be rectified, then a more considered approach developed to manage the problem. For example, the issue around fuel supplied from the auxiliary fuel tanks would probably have been investigated further, or a mitigation put in place. 

A study completed on the factors influencing the decision‑making of commercial pilots flying in outback Australia found that it was common for them to feel pressured to make risky decisions and commit ‘violations’ due to threat of employment termination. It also noted that career ambition was an important factor, with pilots seeking to build flight time for future employment with major airlines, leading them to take risks while flying (Michalski and Bearman, 2014). The extent to which this situation exists within the small aircraft air transport sector is difficult to determine, however the evidence from this investigation indicates that it existed within this operator. 

Regulatory oversight

The purpose of regulatory oversight is to ensure operators are meeting regulatory standards and to monitor the ongoing safety, health and maturity of the operators. This oversight is comprised of both regulatory services activities and surveillance activities.

CASA response to complaints

CASA received a complaint in November 2022 regarding operational issues at Broome Aviation. This complaint was included in the scope of a level 2 surveillance activity conducted by CASA in June 2023, the week prior to the accident. The CASA regulatory oversight flight operations inspector (RO FOI) determined there was no reason to question pilots regarding the complaint after noting the pilots seemed ‘happy’. This perception occurred in an open environment where the FOI, the interim HOFO and the CEO were present with the pilots. 

As CASA noted, complaints regarding the safety culture of an organisation that does not have a safety management system (SMS) can be difficult to assess. Interviews with pilots can provide valuable information, but the usefulness of that information can be limited if only a small sample size was used (and confidentiality could not be maintained), or corroboration from some form of documentary evidence could not be identified. Although there are clearly challenges with examining these types of topics during surveillance activities, on this occasion it appears an important opportunity was missed when the RO FOI did not discuss these concerns with any of the current pilots or bring it to the attention of the operator.

When the surveillance report was submitted by the RO FOI to their supervisor, the RO FOI was not questioned as to why the complaint had not been assessed, even though it was a key reason for the surveillance activity. This was a second missed opportunity for CASA to assess the safety culture within the operator.

When CASA received 2 further complaints after the accident, it had a further opportunity to examine operational issues which encompassed all 3 complaints. Although the complaints were added to the scoping of the level 1 audit in August 2023, the contents of the audit report indicated that they were again not investigated. 

Acknowledging CASA’s difficulty with assessing the safety culture of such an organisation, there were multiple pilots within the organisation who could have provided valuable insights given their extended time and familiarity with the operator. Engaging with these individuals during either of the surveillance activities would have allowed CASA to gather a broader perspective and determine whether the reported organisational issues were systemic or simply reflective of dissatisfaction from potentially disgruntled former employees. As demonstrated during this investigation, there were widespread concerns about these matters within the pilot group. 

Head of flying operations assessment

Broome Aviation’s interim HOFO was firstly assessed by CASA for the position of alternate HOFO for another operator (operator 2) and then again for the position of alternate HOFO for Broome Aviation. CASA was unable to provide documentation outlining the specific elements discussed during the first assessment, so it was not possible to confirm what was specifically covered during that process.

The retention of assessment records ensures accountability and transparency in the evaluation process, including a documented trail of decisions. This transparency is important to ensure that any regulatory approval by CASA is supported by clear, justifiable, and objective assessments. Such records also assist CASA with future assessments of the same candidate.

In this case, this first assessment was used as a basis for CASA’s alternate HOFO assessment of the same candidate for Broome Aviation 19 days later, enabling the process to be expedited. The FOI specified that this assessment was for the alternate HOFO position, however the approval given was for the HOFO position. Although CASA advised that the assessment process for an alternate HOFO and a HOFO position was the same, the FOI noted that they did not complete a full assessment of the applicant’s experience due to the expected short timeframe of the appointment. 

In addition, although no time limitations for a HOFO position could be recorded on the official approval, CASA accepted Broome Aviation’s operations manual, which nominated the substantive HOFO as the HOFO and the newly assessed HOFO in the alternate HOFO position. The operations manual also did not outline how the alternate was going to manage the dual positions while being employed for operator 2 conducting check and training for its pilots and full-time flying, and fulfil the HOFO duties for Broome Aviation. CASA was aware that the substantive HOFO would be on leave and the alternate HOFO would be the acting HOFO. 

CASA did not contact the operator at the end of the month despite only assessing the HOFO for one month. When the operator was advised that the substantive HOFO was extending their leave beyond April, they did not advise CASA of the change in circumstances within 7 days as required.

Upon discovering in February 2023 that the interim HOFO had been conducting the role for longer than the timeframe considered in the assessment, the CASA RO FOI discussed the matter with the interim HOFO. However, CASA did not re-assess the suitability of the interim HOFO to act for an extended period, and to ensure that the interim HOFO was available to effectively oversee Broome Aviation pilots when they returned to operator 2 in March 2023. 

The dual arrangement of a pilot serving as HOFO for one operator and full‑time line pilot for another, posed challenges with:

• operational priorities
• workload management
• operational oversight
• compliance with regulatory requirements.

In this instance, the interim HOFO reduced their flying duties at Broome Aviation to return to flying and conduct check and training for operator 2. The reduction resulted in the interim HOFO having reduced oversight of Broome Aviation pilots during the March–June 2023 period.

Under CASR regulations, key personnel must demonstrate the capacity to discharge their responsibilities fully and effectively. CASA emphasised that it is ‘highly unlikely’ for key personnel to meet this requirement when performing similar duties for multiple operators simultaneously. If this dual arrangement is pursued, the second operator must clearly outline in its exposition how a HOFO will fulfill their responsibilities. This includes ensuring sufficient availability and capability to respond promptly to operational demands. Although in this case CASA personnel stated concern for the operation and oversight of Broome Aviation at the time, the 4-month period in which the interim HOFO was working for both operators resulted in Broome Aviation effectively having little oversight of its pilots. 

Findings

From the evidence available, the following findings are made with respect to the fuel starvation and forced landing involving Cessna 310R, VH-DAW, about 5 km south‑east of Derby Airport, Western Australia on 20 June 2023..

Contributing factors

• The planned flight from Broome to Turkey Creek and return to Derby with the required fixed reserve and contingency fuel could not be achieved without refuelling the aircraft en route. In addition, the pilot did not intend to use all the available fuel in the auxiliary tanks and did not take this into consideration in their pre-flight planning, further reducing the amount of fuel available.
• It is likely that the pilot did not utilise the right auxiliary fuel tank during the first leg of the journey and did not manage usage from the main fuel tanks in accordance with the pilot's operating handbook. This resulted in the depletion of fuel in the main tanks to a level where continuous engine operation could not be maintained
• After the usable fuel in the right main fuel tank had been exhausted, the pilot did not divert the aircraft to the closest airport, select the left engine selection to the left auxiliary fuel tank, or maintain altitude to increase the safety margin.
• The pilot had limited understanding of the aircraft fuel planning and in‑flight fuel management, but due to a lack of consolidation training and limited to no operational oversight these issues were not detected by the operator.
• During the 8-month period from November 2022 until the accident, Broome Aviation provided its pilots transitioning to operating the Cessna 310 with limited supervision, guidance and support, including management of the fuel system. (Safety Issue)
• Aircraft defects were not written on the maintenance release, leading to several defects not being rectified or managed. (Safety Issue)
• The pilot was not wearing an upper torso restraint during the accident flight, resulting in the pilot receiving avoidable serious head injuries during the collision.
• Broome Aviation pilots experienced pressure not to report aircraft defects on maintenance releases, and many pilots also experienced or observed pressure from individuals within the company management to conduct flights in aircraft with defects that they considered made the aircraft unsafe for flight. (Safety Issue)
• Following a complaint by a former Broome Aviation pilot regarding management pressure on pilots to operate unserviceable aircraft, CASA conducted a level 2 surveillance activity on the operator in early June 2023 and following further complaints, a level 1 audit in August 2023, with key scope elements being to evaluate the complaints. Despite that, the surveillance activities and the associated reports did not assess the subject of the complaints.
• The Civil Aviation Safety Authority approved a head of flying operations (HOFO) for Broome Aviation in early December 2022 via an abbreviated assessment due to an expectation that it was an interim appointment, and they had already been assessed. The person subsequently remained in the position for a much longer period. When this was identified by CASA, it did not fully assess the HOFO’s ability to continue undertaking the position when returning to work for another operator full time as a line pilot and alternate HOFO. 

Other factors that increased risk

• The aircraft fuel gauges did not indicate accurately.
• Broome Aviation’s operations manual did not include a procedure for recording inflight fuel calculations. As a result, pilots adopted varying methods for fuel monitoring, leading to reduced assurance of accurate fuel management. (Safety issue)

Safety issues and actions

In-flight fuel management

Safety issue number: AO-2023-029-SI-01

Safety issue description: Broome Aviation’s operations manual did not include a procedure for recording inflight fuel calculations. As a result, pilots adopted varying methods for fuel monitoring, leading to reduced assurance of accurate fuel management.

Organisational pilot supervision

Safety issue number: AO-2023-029-SI-02

Safety issue description: During the 8-month period from November 2022 until the accident, Broome Aviation provided its pilots transitioning to operating the Cessna 310 with limited supervision, guidance and support, including management of the fuel system.

Aircraft defect recording

Safety issue number: AO-2023-029-SI-03

Safety issue description: Aircraft defects were not written on the maintenance release, leading to several defects not being rectified or managed.

Organisational pressure

Safety issue number: AO-2023-029-SI-04

Safety issue description: Broome Aviation pilots experienced pressure not to report aircraft defects on maintenance releases, and many pilots also experienced or observed pressure from individuals within the company management to conduct flights in aircraft with defects that they considered made the aircraft unsafe for flight.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and passenger of the accident flight and multiple other company pilots
• the head of flying operations at the time of the accident
• the operator and substantive head of flying operations of Broome Aviation
• Civil Aviation Safety Authority (CASA)
• Western Australia Police Force
• Textron Aviation
• the maintenance provider for VH-DAW (Broome Air Maintenance)
• the maintenance tracking provider and logbook controller for Broome Aviation (Avtrac Maintenance Tracking)
• Airservices Australia
• video footage of the accident flight and other photographs and videos taken on the day of the accident
• recorded data from the GPS unit on the aircraft.

References

National Transportation Safety Board 2011, Airbag performance in general aviation restraint systems, Safety Study NTSB/SS-11/01.

Stothard C & Nicholson R 2001, Skill acquisition and retention in training: DSTO support to the army ammunition study, Defence Science and Technology Organisation, report DSTO-CR-0218.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the pilot
• other pilots interviewed during the investigation
• Broome Aviation
• Civil Aviation Safety Authority
• Textron Aviation
• National Transport Safety Bureau
• Broome Air Maintenance

Submissions were received from: 

• the pilot
• other pilots interviewed during the investigation
• Broome Aviation
• Civil Aviation Safety Authority
• Textron Aviation
• Broome Air Maintenance

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 9 December 2022 a Bell 206L-3 Longranger helicopter, registered VH-JSU and operated by Forest Air Helicopters, was conducting a low-level wildlife survey out of Deniliquin, New South Wales.

While surveying above forest, the pilot heard a ‘loud bang’, the helicopter pitched nose up, rolled to the left and started vibrating severely. With nowhere to land immediately, the pilot applied cyclic to counter the pitch and roll, and flew straight for about 10 seconds, at which point the vibration effectively stopped. The pilot then flew the helicopter about 2 kilometres to some farmland at the edge of the forest where they conducted a precautionary landing. It was subsequently found that the right, forward, pylon support link assembly had fractured. The link assembly formed part of the nodal beam transmission suspension system, designed to isolate and support the main rotor transmission and rotor, and reduce cabin noise and vibration.

What the ATSB found

The link assembly fractured due to fatigue cracking that initiated as a result of unidentified degradation of the lower, elastomeric bearing. The helicopter manufacturer advised the ATSB of two similar occurrences, causing partial control loss for the pilot and resulting in a hard landing and ditching respectively.

It was likely that the bearing degradation was present at the time of the most recent periodic maintenance inspection, however, the helicopter maintainer had not been removing the link assemblies in accordance with the helicopter manufacturer’s maintenance manual inspection requirements. This reduced the likelihood of detection of the degraded bearing.

What has been done as a result

The helicopter maintainer has updated its maintenance scheduling to include the requirement to remove the link assemblies for detailed examination in accordance with the maintenance manual.

Safety message

Maintenance personnel are reminded to ensure that all required maintenance procedures are appropriately reflected in their maintenance scheduling. Additionally, when inspecting for evidence of elastomeric degradation, consideration should be given to the particular installation or the presence of protective coatings that could potentially inhibit the release and detection of wear material.

The occurrence

On 9 December 2022 a Bell 206L-3 Longranger helicopter, registered VH-JSU and operated by Forest Air Helicopters, was conducting a low-level wildlife survey from Deniliquin, New South Wales. The helicopter had a pilot and 3 aerial work passengers on board.[1] The survey flights were conducted at 30 kt, about 5 to 10 m above the forest canopy. The occurrence flight was the second of the day and the helicopter had been flown for around 5 hours the previous day, without issue.

For the occurrence flight, the helicopter departed Deniliquin around 1100 and conducted a 20-minute transit to the survey site, about 60 km to the south-west. The crew completed a ‘5-mile’ survey run and were halfway down the second run when the pilot reported a ‘loud bang’, after which the helicopter pitched nose-up, rolled to the left and started vibrating severely.

The helicopter was above thick forest at the time and there was nowhere in the immediate vicinity to land safely.  The pilot used cyclic inputs to compensate for the uncommanded pitch and roll and found that the helicopter could be flown straight. After about 10 seconds of flying straight and level, the vibration had effectively stopped. The pilot assessed that the helicopter was still flying well and conducted a slow turn to reach some farmland, about 2 kilometres away, at the edge of the forest. The pilot conducted a precautionary landing on the farmland and there were no injuries or damage as a result of the occurrence.

It was subsequently found that the right, forward, transmission link assembly had fractured
(Figure 1). It was noted that the fractured ends of the link had become fouled on each other, which was considered to be the reason for cessation of the airframe vibration.

Figure 1: Right, forward, pylon support link assembly fracture

Source: helicopter operator, modified by ATSB

Aircraft information

The Bell 206L-3 Longranger, serial number 51071 and registered as VH-JSU, was manufactured in the United States in 1983 and first registered in Australia in 2014. At the time of the occurrence, the airframe had accumulated 8,054 hours.

Pylon support link assembly

The Bell 206L-3 employs a nodal beam transmission suspension system to isolate and support the main rotor transmission and rotor, and reduce cabin noise and vibration. It consists of:

• a left and right flexure assembly attached to support mounts, secured to the cabin roof beam
• transmission restraint via 4 interchangeable pylon support link assemblies.

The link assemblies (part number 206-033-554-101) were forged aluminium alloy with elastomeric bearings at either end. The fractured link assembly, serial number LK12471, also displayed superseded part number 206-033-503-1, which indicated that the assembly had been upgraded from the original steel monoball (spherical) bearings to the elastomeric configuration preferred by Bell.

Link assembly examination

The fractured link assembly was removed by the maintenance provider on 14 December 2022 and examined at the ATSB technical facilities in Canberra.

The link fractured approximately 75 mm from the centre of the lower bearing. The fracture surface showed evidence of a high-cycle fatigue crack extending through approximately three-quarters of the cross-sectional area (Figure 2). A shallow area of mechanical deformation was identified at the crack origin, which was estimated to be within the Bell 206L Component Repair and Overhaul Manual allowable limits.[2] Metallographic examination and hardness testing showed that the link was manufactured from a forged, high-strength aluminium alloy. The ATSB identified no material or manufacturing defects within the link that would significantly affect the fatigue life of the part.

Figure 2: Fractured link assembly and fatigue crack detail

Source: ATSB

The lower elastomeric bearing exhibited severe wear. The bearing is comprised of 3 concentric steel shims plus an inner member, each separated by elastomer. The innermost shim had completely worn through as a result of metal-to-metal contact with the inner member and the transition shim (Figure 3). The elastomer had been abraded away and/or extruded from between the steel elements. Away from the primary wear, the elastomer showed cracking and cohesive failure. The degree of metal-to-metal shim wear indicated that the bearing had operated for an extended period of time in a degraded state, although the ATSB was unable to more accurately assess the operational period.

A clear polymer coating had previously been applied to the surface of the bearing/elastomer at both ends of the link assembly. This had become loose and largely separated from the elastomer of the lower bearing. The ATSB was unable to visually assess the surface condition of the upper bearing elastomer through the applied coating.

Figure 3: Lower elastomeric bearing

Inner member removed for right hand image to show shim wear. Note: Inner member was designed with non-concentric bore and this was not a feature of the bearing damage.

Source: ATSB

The link assembly was shipped to Bell Textron for examination under the supervision of a representative from the United States Federal Aviation Authority. Bell confirmed that the link material and manufacture conformed to drawing requirements, and that the area of mechanical damage at the crack origin was within allowable limits. Bell concluded that the shim fretting damage and wear, and deterioration of the elastomer was consistent with bearing degradation during service and that, as the bearing degraded, loads in the link would have increased.

Bell subsequently forwarded the link assembly to the manufacturer, Parker Lord, which determined that the part was consistent with its manufacturing methods and there was no indication that the part was inauthentic. Parker Lord also noted that the clear material found around both ends of the link, encapsulating the elastomer, had not been applied by them.

Maintenance requirements

The Bell 206L-3 maintenance manual provided for either ‘progressive’ or ‘periodic’ airframe inspection programs. The progressive inspections were divided into inspections of different maintenance areas on the helicopter, to be completed within a 12-month period. The periodic inspections combined all the progressive inspections into one event.

Both the 100 and 300-hour progressive inspection events have tasks requiring inspection of ‘transmission link assemblies for damage and deterioration’ and reference chapter 63 of the Bell 206L3 Maintenance Manual. Relevant to this investigation were section 63-117, which contained an inspection procedure for the link assemblies, and the following section, 63-118, for inspection of the link assembly elastomeric bearings. Section 63-118 was prefaced with a statement indicating ’inspection of elastomeric bearings is feasible only with the link assembly removed from the helicopter.’

Section 63-119 of the maintenance manual detailed a procedure for sealing the elastomeric components with a silicone adhesive, to protect the elastomeric components against contact with oil, which can cause premature degradation of the elastomer. The procedure advised that the coating should be replaced if it cracks, peels or becomes loose on the elastomer, and cautioned that the replacement coating thickness should not prevent proper inspection of the component for deterioration.

The link assemblies did not have a retirement life and were maintained on-condition. Bell was unable to advise on the typical life of the link assembly elastomeric bearing, as it varies depending on the applied loads, operating environment and preventative maintenance. Parker Lord’s general advice on elastomeric bearings is that they are designed to have a long life and they have ‘gradual’ modes of degradation.

Maintenance history of VH-JSU

Link assembly LK12471 was installed in the right, front position on the airframe in July 2003 at 3,507 airframe hours. The link assembly was installed with zero hours as an overhauled item. The manufacturer, Parker Lord, had a record of LK12471 in its repair station in April 2003. There was no record of the link assembly having been overhauled in the time since the original installation, and therefore the component had likely accumulated 4,547 hours in service at the time of the occurrence.

ATSB examination of maintenance records indicated that relevant inspections had been done at the appropriate intervals. The most recent airframe periodic inspection was conducted on 8 November 2022, 12 flight hours prior to the occurrence. The inspection of the link assemblies was visual and conducted without removal of the parts from the helicopter. There was no defect recorded.

The maintainer, Forest Air Maintenance Engineering, reported that link assemblies were not routinely removed for periodic inspections. They were unaware of the manufacturer’s requirement to remove the link assemblies for inspection, which was therefore not included in the maintenance scheduling. The maintainer advised that during maintenance inspections, they visually examined elastomeric components for evidence of ‘dust’ or ‘crumb’ that is generated as the elastomer deteriorates.

The maintainer further advised that the links had most recently been removed from the helicopter during inspection of the main transmission, 587 hours prior to the occurrence. No formal inspection was documented, however the maintainer stated that because the links had been removed from the helicopter, it was likely they were visually inspected at that time.

Previous occurrences

Bell advised the ATSB of two link assembly fractures in other helicopters. Both were in the right, front location and fractured as a result of fatigue cracking in approximately the same location as the VH-JSU link. Both occurrences caused partial control loss for the pilot.

• The first occurrence involved a hover-taxi at an airport at 20-50 ft above the ground. A large ‘crack’ sound was heard, after which the pilot was unable to maintain level flight. A hover-autorotation was attempted and resulted in a hard landing. The pilot and passengers were uninjured. The fractured link was found to have degraded bearing elastomer and metal-to-metal shim contact. The link assembly was also found to have had a bearing overhaul using a method that was not approved by the manufacturer.
• The second occurrence happened during a sightseeing flight at around 900 ft. A large ‘bang’ was followed by an uncommanded left bank. The pilot attempted to compensate with control inputs, but was unable to maintain both altitude and direction. The pilot attempted a ditching but upon flaring the helicopter, it rolled left and impacted the water. All occupants were able to egress and swim to shore. The link assembly showed evidence of elastomer degradation and the fracture was attributed to ineffective maintenance practices.

A search of the Civil Aviation Safety Authority and US Federal Aviation Administration service difficulty reporting databases found one related report, involving a model 206L-1 with a left, rear link assembly fracture, in 2008. That occurrence resulted in a precautionary autorotation landing. There were no further details on the reason for the fracture.

Safety analysis

The uncommanded helicopter pitch nose-up and roll to the left was consistent with fracture of the right, forward, pylon support link assembly. Previous occurrences have resulted in a partial loss of control and forced landing, resulting in helicopter damage. The pilot in this instance was able to apply compensatory control inputs and continue the flight to a safe landing site, probably due to the fractured link being caught on itself and providing some residual support to the rotor pylon.

The degradation and wear of the lower elastomeric bearing would have progressively generated excess clearance and movement in the bearing, ultimately leading to the metal-to-metal shim contact. This would have also resulted in an abnormal loading condition through the link assembly during normal operation. In the absence of any pre-existing defect in the link, the bearing degradation was the most likely reason for initiation and propagation of the fatigue crack.

It was not possible to determine with certainty how long the helicopter had operated with visible wear on the bearings. However, the gradual degradation of elastomeric bearings under normal conditions, coupled with the extent of shim wear on the fractured link assembly bearing, indicated that the helicopter had been operating for an extended period with the link assembly bearing in a degraded state. It follows that some elastomeric degradation and shim wear would have been present at the most recent periodic inspection, 12 flight hours prior to the occurrence. However, the most significant degradation was positioned such that it would have been shielded to some extent by the installation in the flexure assembly (Figure 1 and 3). As the maintainer had not identified and applied the maintenance manual requirement to remove the link assemblies for inspection, the likelihood of detection of cracked or degraded bearing elastomer was reduced.  

Furthermore, without disassembly, the maintainer was largely relying on visual indications of elastomer dust or crumb on the component surfaces adjacent to the bearing. While the protective adhesive coating is applied to the elastomer surface to help prevent premature degradation through fluid contamination, as a barrier coating, it is also likely to reduce the prevalence of these visual indications. Additionally, if applied too thickly, it could also hinder direct visual observation of the bearing condition. For this reason, maintainers should account for the potential influence of protective coatings on inspections.

From the evidence available, the following findings are made with respect to the transmission support, link assembly fracture involving Bell 206L-3, VH-JSU, 60 km south-west of Deniliquin Aerodrome, New South Wales on 9 December 2022.

Contributing factors

• The helicopter's right, forward pylon support link assembly fractured due to fatigue cracking that initiated as a result of degradation of the lower, elastomeric bearing.
• The pylon support link assembly was not removed for inspection during the last periodic maintenance. This reduced the likelihood of maintenance personnel detecting the degraded elastomeric bearing.
• The maintainer had not identified the maintenance manual requirement to remove the pylon support link assemblies from the helicopter for periodic inspection of the elastomeric bearings.

Safety actions

Safety action by Forest Air Maintenance Engineering

Forest Air Maintenance Engineering updated their maintenance scheduling to include the requirement to remove the link assemblies for detailed examination in accordance with the maintenance manual.

To improve detection of elastomer degradation and in consultation with the helicopter manufacturer, the maintainer has elected to omit the protective silicone adhesive layer from the bearings. The maintainer is instead proactively managing the source of any fluid leaks to limit the likelihood of oil contamination of the bearings.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot
• helicopter maintainer
• helicopter manufacturer
• pylon link assembly manufacturer.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot of the accident flight
• helicopter maintainer
• helicopter manufacturer
• pylon link assembly manufacturer
• Transportation Safety Board of Canada.

There were no comments submitted.

On the morning of 20 April 2022, a Kubicek BB78Z hot-air balloon, registered VH‑RJR and operated by Liberty Balloon Flights, was being prepared for a balloon transport[1] flight for 13 passengers from Royal Park, Victoria. This was the first flight of the balloon since manufacture and the intended destination was Moorabbin Airport.

Before the flight, the pilot conducted a pre-flight inspection. This involved partially inflating the balloon envelope with a fan while on the ground to inspect the deflation vent system (see the section titled Balloon information). The basket contained 6 full propane fuel tanks, sufficient for the intended flight, and the burners were used to inflate the envelope with hot air. After the balloon was ‘stood up’, the pilot confirmed the correct functioning of the deflation vent system.

After the pre-flight inspection, the passengers boarded the balloon, and at 0635, the balloon departed for an anticipated 1-hour flight. The pilot noticed during the pre-flight heating and initial stages of the flight, that the overlap of the vent panel – a fabric panel used to vent air out of the circular opening at the top of the balloon (vent aperture) – and the vent aperture was smaller than on other Kavanagh balloons they had flown. However, the deflation system was sealing correctly during these stages, and so the pilot was not concerned. Passenger images showed the vent panel before take-off and about 2 minutes after take-off (Figure 1). The image taken shortly after take-off showed that the vent panel was close to, or was, pushing through the vent aperture.[2]

Figure 1: Vent panel before (left) and after (right) take-off

Source: Passenger

At about 0640, the pilot activated the burners to ascend above the Melbourne Central Business District (CBD). About 4 minutes later, and with the balloon flying over the CBD, the pilot noticed a small gap between the edge of the vent aperture and the vent panel. This gap allowed hot air to leak out, reducing the buoyancy of the balloon. The pilot attempted to seal the gap multiple times using the deflation system rope lines but was unsuccessful and decided that a forced landing was necessary. The pilot then descended the balloon to a lower altitude in search of a suitable landing location. As the flight progressed, the gap between the vent aperture and the vent panel expanded and altitude control became increasingly difficult, with precise altitude control no longer possible.

At about 0656, the pilot attempted a landing in Fawkner Park (Figure 2), but as the balloon descended over the Royal Botanic Gardens it tracked away from the larger central areas of the park. The pilot heated the envelope and ascended into north-westerly winds to attempt to track back towards the park’s centre but was unsuccessful. The balloon then continued to track south‑south‑east along the western edge of the park adjacent to nearby buildings.

Figure 2: Balloon flight track

Source: Google Earth and Hot Air, annotated by ATSB

At about 0706, the pilot descended the balloon to track towards Elwood Beach and instructed the passengers to adopt the landing position. During the descent, the balloon’s basket impacted a glass fence on top of a building. Shortly after, the pilot advised the passengers of a malfunction with the deflation system, for them to remain in the landing position, and the intent to land at Elwood Beach. The pilot continued to fly the balloon at low altitude towards Elwood Beach, which required almost continual operation of 1 or 2 of the balloon’s 3 burners to maintain altitude, with precise altitude control not possible.

At about 0714, the balloon’s basket impacted the top of another building. At about this time, liquid fuel for 2 of the balloon’s 3 burners was exhausted, significantly reducing the heat generated by those burners and rendering them ineffective.[3] Unable to maintain altitude, the pilot continued to activate the remaining burner to reduce the descent rate as much as possible as the balloon descended through trees into a suburban street. As the balloon struck the trees, the pilot pulled the fast deflation line to deflate the balloon envelope. However, this was only partially accomplished as tree branches pulled the line out of the pilot’s hands.

During the landing, the basket was not orientated with the long side perpendicular to the direction of travel. Although this was the normal procedure for any landing, the impact with the trees rotated the basket, and the pilot did not have time to correct this using the balloon’s rotation vents. Furthermore, using the rotation vents would have increased the rate of descent.

The basket came to rest outside the entrance of an apartment building and the envelope deflated over the building’s roof (Figure 3). The balloon and basket sustained minor damage during the forced landing, and 3 passengers sustained minor injuries.

Figure 3: Balloon landing site during the post-incident recovery

Source: ATSB

Context

Pilot information

The pilot held a commercial pilot licence (balloon) and had accumulated 3,950 hours of flying experience, of which about 300 hours were on balloons in the same class[4] as the BB78Z. The pilot had flown 60 hours in the previous 90 days. The occurrence flight was the first flight the pilot was undertaking in a BB78Z.

In discussing the incident, the pilot stated that:

• After noticing the deflation system was not sealing correctly, the pilot maintained the balloon’s altitude as low as possible because it was safer and provided more potential landing areas. The heat required to ascend would have increased the fuel burn, reducing the balloon’s endurance. Moreover, later in the flight, keeping a lower altitude provided the shortest route to Elwood Beach – an area the pilot had previously landed a balloon. However, due to this low altitude with precise altitude control impossible, the pilot could not slow the balloon’s descent fast enough to avoid colliding with the two buildings.
• Albert Park was a potential landing option, but the recent Formula One Grand Prix race meant that there was still a lot of work happening at the park with lots of associated equipment. The reduced altitude control would have also made it difficult to manoeuvre towards the park for a landing.
• Elsternwick Park was also an option, but based on the prevailing winds would have required an ascent, increasing the fuel used. Therefore, the pilot attempted to land at Elwood Beach.

Figure 4: Balloon flight track with potential landing options

Source: Google Earth and Hot Air, annotated by ATSB

Meteorological information

North-north‑west surface winds at 7-8 kt and an air temperature of 11 °C were forecast at Essendon Airport and Moorabbin Airport for the balloon’s expected flying time.

The balloon’s GPS unit recorded its velocity during the flight (indicative of wind speed and direction) which, after descending over the Royal Botanic Gardens, mostly varied between 6‑10 kt.

Balloon information

The BB78Z is a 275,000 cubic feet hot-air balloon produced by Kubicek Balloons, a balloon manufacturer based in Czechia. The incident balloon (VH-RJR) was manufactured in 2021 (Figure 5) and included a T‑partitioned basket with 2 passenger compartments fitted with rope handles, and a triple burner system. The envelope has vertical load tapes which transfer the internal envelope forces to carry the basket, and 24 gores (vertical fabric panel sections between vertical load tapes).

Figure 5: VH-RJR

Source: ATSB

The balloon was equipped with a Kubicek 3-line deflation system (Figure 6). In-flight venting was achieved by pulling on the red-white line (parachute vent line) which in turn pulled the vent panel (Figure 7) at the top of the balloon for a controlled release of air through the vent aperture. Releasing the parachute vent line allowed the vent panel to close, being pushed upwards by the pressure of the heated air within the envelope.

The parachute vent line was used to descend the balloon, such as when approaching to land. For final landing, when the balloon was close to the ground, the fast deflation line (red line) was pulled so that the centre of the vent panel was pulled down into the balloon for rapid deflation. A white line was connected to the shroud centralising lines to stretch the vent panel over the vent aperture for proper sealing and to also reset the vent panel after the red line was pulled. A weight was attached to the white line to assist with sealing.

Figure 6: VH-RJR deflation system

Source: Kubicek Balloons, annotated by ATSB

Figure 7: Vent panel

Source: ATSB

The envelope was fitted with a temperature label which was a small strip sewn into the envelope fabric with several temperature-sensitive areas (116-154 °C) that changed colour permanently according to the maximum envelope fabric temperature reached. The envelope was also fitted with a temperature warning streamer which fell towards the pilot if the envelope air temperature exceeded its maximum limit of 124 °C.[5] Both temperature indicators were located internally near the top of the balloon.

Before the flight, the pilot completed a load chart based on the temperature at the launch site (10 °C) and expected maximum altitude (3,000 ft). This indicated that there was sufficient available lifting capacity to conduct the flight.  

Number of passengers

The balloon’s basket had 2 passenger compartments, each with a maximum occupancy of 6 people, which was based on a minimum floor area for each person. This number was independent of the actual weight and size of the passengers, which also needed to be considered by pilots before each flight. The manufacturer advised that the maximum passenger compartment occupancy must never be exceeded due to the limited number of rope handles available, and the requirement for each passenger to adopt a safe and comfortable landing position.

On the incident flight, 7 people (adults and children) were carried within one of the passenger compartments. Although the additional passenger was reportedly able to adopt a good landing position, and no injuries were reported by this passenger, the carriage of the additional passenger increased risk. While the ATSB assessed that the risk was not significantly increased in this case, it is important that pilots adhere to the flight manual passenger limitations.

Post-incident balloon testing

The balloon was retrieved from the incident site and stored in a secure facility. In May 2022, the ATSB arranged for tests to be conducted on the balloon’s deflation system in Yarra Glen, Victoria. Representatives from the ATSB, balloon manufacturer, operator (including the incident pilot), and the Civil Aviation Safety Authority (CASA) were in attendance.

The envelope was first inflated on the ground using a fan to conduct an external and internal inspection of the envelope (Figure 8), with the following observed:

• pulleys and rope lines were serviceable
• there was minor impact damage to the envelope fabric from the landing
• the temperature streamer was intact and the temperature indicator colour was unchanged.

Figure 8: Internal envelope inspection

Source: ATSB

A wireless temperature sensor was fitted to provide an indication of the maximum internal envelope air temperature reached during the test. The basket was tethered, and the burners were used to inflate the envelope. People were loaded into the basket to provide a similar weight to the incident flight. The ambient air temperature at the time of the test was about 7 °C at 230 ft above mean sea level.

The internal envelope air temperature was increased by operating the burners, while external and internal camera footage of the vent panel was taken (Figure 9). At low temperatures, the vent panel began to push up against the internal envelope and vertical load tapes as designed, creating a seal. At about 90 °C, edges of the vent panel between the vertical load tapes pushed up through the aperture creating many gaps for internal envelope air to vent out. Attempts to seal the gaps using the parachute vent line and white line were unsuccessful. At higher temperatures, the gaps became larger and more numerous.

Photos and video taken during the test indicated vent panel behaviour similar to that shown in the passenger’s video of the incident flight (Figure 1). The incident pilot also reported that the vent gaps were very similar to those observed during the incident flight. The balloon envelope was subsequently shipped to the manufacturer’s headquarters in Czechia for further examination.

Figure 9: Deflation system testing

Temperature values are approximate

Source: ATSB

Deflation system design change

The European Union Aviation Safety Agency (EASA) is the civilian aviation safety regulator for the European Union, responsible for prescribing minimum standards required in the interest of safety for the:

• design
• material
• construction
• quality of work
• performance

of aircraft, aircraft engines, and propellers. EASA issue sets of certification requirements based on aircraft category. Successful completion of the certification process, where an aircraft (such as a balloon) complies with the certification requirements, enables the aircraft to receive a type certificate.

The BB78Z was certified under the EASA regulations, receiving a type certificate from EASA in 2016. For the BB78Z, the relevant EASA certification requirements were found in the certification specification for hot air balloons (CS‑31HB).

Before VH-RJR was manufactured in 2021, the operator requested a larger deflation vent (aperture and panel) to increase the balloon’s descent performance. Greater descent performance was desirable for flights over built-up areas such as Melbourne, where landing options were limited and small in area. To accommodate the request, the manufacturer increased the radius of the vent aperture from the standard 3.6 m to 4.0 m, and utilised the 4.0 m deflation system design that already existed on the manufacturer’s larger balloons. This modification was to be accomplished via a change to the balloon’s type certificate.

Changes to a type certificate under EASA regulations followed a general process:

• Classification of the proposed change as either ‘major’ or ‘minor’[6] to determine the approval pathway.
• Determining the certification requirements affected by the proposed change.
• Providing evidence that the change is compliant with the affected certification requirements.

Change classification

Kubicek held a Design Organisation Approval^[7] issued by EASA that granted privileges to develop and approve minor changes and some major changes, including new deflation systems (major change) and an exchange of deflation systems between different balloons (minor change). A change that Kubicek was not authorised to approve, could be developed by Kubicek and submitted to EASA for approval.

As the VH-RJR deflation system design change was based on the 4.0 m deflation system used on its larger balloons, Kubicek classified it as a ‘minor change’.

Approval

During the design change process, the certification requirements affected by the change are determined. Approval of the change is then based on whether compliance with the certification requirements can be demonstrated. The manufacturer listed the following certification requirement as being affected by the deflation system design change:

The manufacturer’s design change approval form listed 8 documents against this requirement as evidence of compliance, and formed the basis upon which the deflation system design change was approved. The ATSB’s review of the compliance documents found that each one contained engineering drawings showing the larger 4.0 m deflation system geometry on the BB78Z balloon, but no evidence that the design met the stated certification requirement. The manufacturer provided the following comments on the design change approval:

• No further analysis or testing was required for compliance with the certification requirement since previous certification activities and in-service experience showed that the 4.0 m deflation system design was suitable on larger balloons.
• Although not explicitly part of the design change approval, the tethered manufacturer production test would provide some assurance on the suitability of the modified design.

Kubicek approved the design change and then manufactured VH-RJR with the modified deflation system. VH-RJR was the only balloon with this deflation system design change produced.

Post-incident investigation

After the incident, Kubicek compared the manufactured deflation system dimensions with the original design drawings and found no differences. The design differences between the VH‑RJR deflation system and the same size deflation system fitted to the manufacturer’s larger certified balloons was also reviewed. This found that when incorporated into the smaller BB78Z balloon, the vertical load tape spacing at the edge of the vent panel (Figure 10) differed from other designs as follows:

• VH-RJR BB78Z with 24 gores and 4.0 m radius vent aperture – 1,042 mm spacing
• Standard BB78Z with 24 gores and 3.6 m radius vent aperture – 940 mm spacing
• Standard larger balloon with 28 gores and 4.0 m radius vent aperture – 893 mm spacing

Figure 10: VH-RJR vent panel spacing between load tapes

Source: ATSB

Regarding the effect of the increased vertical load tape spacing on VH‑RJR, Kubicek stated:

Manufacturer testing

All balloons manufactured by Kubicek were subject to a tethered test to ensure the balloon flight controls performed correctly and the balloon was in a condition for safe operation. The test involved the following:

• balloon assembled with an internal envelope air temperature sensor, with the basket tethered to the ground
• weight placed in the basket to allow internal envelope temperature to be raised to a minimum of 100 °C (not to exceed 124 °C)
• heat the balloon to achieve a height of 0.5-3 m above the ground for at least 30 seconds
• record the take-off temperature and maximum temperature achieved
• check the function of the deflation system and rotation vent
• conduct a visual inspection of the balloon shape.

The VH-RJR test was performed with an ambient air temperature of 7 °C and at 814 ft above mean sea level. The test report indicated that the maximum internal envelope temperature reached 114 °C, with no issues with the deflation system function. After successfully completing the test, the balloon was delivered to the operator.

Post-incident investigation

The post-incident testing arranged by the ATSB on VH-RJR indicated that gaps in the deflation system were forming between the vent panel and edge of the vent aperture at about 90 °C internal envelope temperature. This temperature was below the reported temperature reached during the manufacturer test with similar ambient conditions (temperature and altitude) such that similar internal envelope temperatures created comparable internal envelope pressure. To examine this discrepancy, Kubicek used software to estimate the actual envelope air temperature reached during the test. The software estimated that the maximum internal envelope temperature only reached about 89 °C instead of the 114 °C recorded on the report.

Temperature sensors

As part of the manufacturer’s tethered test, a wireless temperature sensor (probe and transmitter) was fitted to the top of the envelope to record the internal envelope air temperature. The sensor probe was placed inside a Velcro tab designed to measure the temperature at 20 mm from the envelope fabric surface during the test (Figure 11). A receiver located in the pilot’s compartment was wirelessly linked to the temperature transmitter and provided the temperature reading during the test.

Figure 11: Envelope air temperature sensor

Source: Kubicek, modified and annotated by ATSB

The primary purpose of the temperature sensor was to ensure that the test’s minimum envelope air temperature was achieved (100 °C), and the maximum allowable temperature (124 °C) was not exceeded. The envelope air temperature is directly related to the buoyancy force acting on the balloon which is generated by the heated air within the envelope. Significantly, as the internal envelope air temperature increases compared to the ambient air temperature outside the envelope, the pressure pushing upwards on the vent panel also increases.

The position of the sensor probe from the envelope fabric was important to obtain the targeted temperature reading as the air temperature within the envelope could vary significantly depending on location. Balloon temperature sensor research data indicated that at the top of the balloon, where the heated air accumulates, the temperature reading would increase as the sensor moved away from the fabric. For example, a sensor that was 20 mm from the fabric could read 25 °C higher than if positioned directly on the fabric.

In addition to sensor probe position, temperature sensor readings can also be affected by aging during storage, thermal stress, mechanical stress, receiver issues, and calibration problems.

Kubicek provided the following information regarding the use of temperature sensors:

• Different models of temperature sensors and receivers were used to conduct the tests and each sensor and receiver combination was subject to an annual functional check. The sensors were not subjected to any recurrent calibration after purchasing from the temperature sensor manufacturers.
• The tethered test inflation procedure did not include any procedures for the installation of the temperature sensors.
• Information on the type of temperature sensor and receiver used during the tethered test inflations did not need to be recorded, and was not recorded during the VH‑RJR test.

The ATSB and balloon manufacturer reviewed images and video from the VH-RJR manufacturer test, but no conclusions could be drawn about the type of temperature sensor used, its location, or how it was installed.

Entry into service

Based on the BB78Z type certificate issued by EASA in 2016, CASA issued the BB78Z with a type acceptance certificate[8] in 2018, making the model eligible to receive an Australian standard certificate of airworthiness (CoA).

Under CASA’s Civil Aviation Safety Regulations, an imported aircraft certified by a recognised national aviation authority (including EASA) can be issued with a standard CoA if CASA or an authorised person[9] is satisfied that:

(a)  the aircraft conforms to the type design; and

(b)  any modifications or repairs to the aircraft have been carried out in accordance with a supplemental type certificate or an approved modification/repair design; and

(c)  the aircraft is in a condition for safe operation

In practice, this process involved review of relevant documentation such as the type certificate, modification and repair approvals, maintenance records, log books, flight manual, and compliance with any airworthiness directives. The issue of the CoA was reliant on the accuracy and completeness of the information available and the information provided to CASA or authorised person by the applicant.

An inspection of the aircraft, either remotely through photos or a physical inspection, was also required to confirm that the aircraft's physical condition was acceptable and in a condition for safe operation. A manned free balloon[10] such as the BB78Z, also required a test inflation to ensure there were no obvious flaws, but the test was not mandatory if a similar test inflation had been entered in the balloon's logbook.

The operator received delivery of VH-RJR on 13 April 2022 – one week before its first flight (the incident flight) – and arranged for information to be submitted to an authorised person to apply for the CoA. Included in the supplied information was an extract from the balloon’s logbook which showed a 0.5 hour flight for the balloon manufacturer’s tethered test in October 2021.

The authorised person reviewed the supplied information and filled out the necessary checklists. The CoA for VH‑RJR was issued on 17 April 2022, with no associated limitations, and permitted the aircraft to begin passenger carrying operations. Once the CoA had been issued, there was no requirement for the operator to conduct any test flight before entry into service.

In discussing the VH-RJR CoA process, the authorised person stated the following:

• No test inflation was conducted as part of the CoA application process since the balloon’s logbook included an entry for a manufacturer test.
• If a test inflation was conducted as part of the CoA application, in terms of checking deflation system operation, it would only require a functionality check, which would be performed at relatively low envelope air temperatures. Since the deflation system problem identified on VH‑RJR occurred at relatively high envelope temperatures, the problem with the deflation system would very likely not have been identified during such a test.
• None of the information supplied to the authorised person as part of the CoA application indicated that the envelope’s deflation system had been modified. However, for a new aircraft such as VH-RJR coming from the manufacturer, there was an assumption that any changes had been done in accordance with the type design, and any manufacturer approvals would be available. Therefore, even if the modification approval was reviewed as part of the CoA application, the CoA would still have been issued.

Safety analysis

Incident flight

On the morning of 20 April 2022, VH‑RJR was being prepared for a balloon transport flight for 13 passengers from Royal Park, Victoria to Moorabbin Airport. This was the first flight of the balloon since manufacture.

As the deflation system issue only became visible at elevated envelope temperatures normally reached during flight, the pilot was unable to identify the issue during the pre-flight checks. Shortly after VH-RJR departed, the pilot activated the burners to climb over the Melbourne CBD, raising the air temperature in the envelope which increased the upwards pressure on the vent panel. The increased pressure pushed the panel’s edge through the aperture creating gaps for the envelope air to leak out. The pilot noticed this, and after unsuccessful attempts to seal the gaps, decided to look for a suitable location for a forced landing.

Landing in built-up areas is challenging due to the many obstacles and limited large open spaces. Fawkner Park and Albert Park were potential landing areas, but both presented a high risk of collision with the adjacent buildings, while flying to Elsternwick Park would have required more fuel than Elwood Beach. The pilot's decision to remain at low altitude provided the best chance of completing a safe landing. Further, aiming for Elwood Beach, an area with minimal people and obstacles, and in the direction of the wind, was a suitable option.

The air escaping out of the envelope around the vent panel made it difficult for the pilot to control the balloon’s altitude and flight path, and required significantly increased burner use (and therefore fuel) to maintain altitude. In combination with flying at low altitude to search for a suitable landing location, obstacle avoidance was difficult, and the balloon’s basket collided with 2 buildings during the flight. However, the pilot instructed the passengers to adopt the landing position before each collision to reduce the risk of injury.

Although there was sufficient fuel on-board to conduct a normal balloon flight to Moorabbin Airport, the increased fuel burn to keep the balloon aloft reduced the fuel to a level where altitude could no longer be maintained. This occurred during the approach to Elwood Beach, and consequently, the pilot decided to land the balloon in a suburban street. During the forced landing the basket collided with trees and then terrain, resulting in minor injuries to 3 passengers.

Deflation system design change

Before VH-RJR was manufactured, the operator requested a larger deflation system to improve the BB78Z’s descent performance. The design change to the deflation system was classified as ‘minor’ and therefore approved internally by the manufacturer, Kubicek, within its EASA design organisational privileges. The change was based on the larger deflation system used on the manufacturer’s larger certified balloons.

As part of the design change approval process, the manufacturer needed to demonstrate that the change was compliant with relevant BB78Z certification requirements – which in this case was to establish the suitability of the design change by tests or analysis. However, the documentation used to show compliance with this requirement did not contain any tests, analysis, or information to demonstrate that the design was safe and suitable to use on the BB78Z.

The design change approval was based on 2 undocumented and incorrect assumptions:

• A previously certified design feature would be suitable on a different sized balloon, even though the vent panel geometry between the vertical load tapes changed due to the different number of gores.
• The manufacturer’s tethered test would provide assurance of the design’s suitability.

Implementing the 4.0 m deflation system design, used with the larger 28 gore balloons, on the BB78Z with only 24 gores, resulted in longer spacing between the vertical load tapes at the vent aperture edge. As this increased spacing was the only geometric difference identified, and production issues were ruled out, the longer spacing most probably allowed normal envelope pressure to push the vent panel up through the vent aperture.

Since no assessment on the design’s suitability was conducted during the design process, the design issues were not identified prior to approval of the change. The balloon was subsequently manufactured with the modified deflation system and subjected to the manufacturer’s production test.

Manufacturer production testing

All balloons manufactured by Kubicek were subject to a tethered test to ensure the balloon flight controls performed correctly and the balloon was in a condition for safe operation. The internal envelope temperature recorded on the VH-RJR manufacturer production test report (114 °C) was above the minimum required value (100 °C). However, based on post-test calculations, the actual temperature reached during the test was probably only about 89 °C. Information on the temperature sensor used during the test, its location, or how it was installed, was not available, so it was not possible to determine the reason for this significant temperature discrepancy.

Significantly, the lower envelope air temperature achieved during the test reduced the upwards pressure on the vent panel. As a result, the deflation system design problem, which began to occur at about 90 °C, was not identified. If the temperature reading during the test had been accurate and the minimum required value of 100 °C had been achieved, the vent panel gaps would have almost certainly been identified during the test. However, the production test was not a design‑related test, and as such, could not be relied on as assurance that a design was safe and suitable for use. For example, if the vent panel started to push up through the aperture at a temperature above 100 °C, the production test could be passed with a deflation system issue present.

The internal envelope temperature was an important parameter to record during the production test as it ensured that normal anticipated pressure acting on the vent panel were achieved. However, the manufacturer had limited ability to verify that the temperature being recorded was accurate since:

• there was no procedure or information about the installation and correct positioning of the temperature sensor
• the accuracy of the temperature sensors used by the manufacturer was not known
• a single temperature sensor was used.

If the manufacturer had sufficient means to verify that the recorded temperature sensor readings were accurate, the incorrect temperature reading during the VH-RJR test would almost certainly have been identified.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Kubicek Balloons BB78Z, VH-RJR, 15 km north‑west of Moorabbin Airport, Victoria on 20 April 2022.

Contributing factors

• The balloon's modified deflation system had longer spacing between the vertical load tapes at the vent aperture edge compared to the standard deflation system design. This spacing allowed normal envelope pressure to push the vent panel upwards through the vent aperture, allowing air to leak uncontrolled out of the envelope.
• Shortly after take-off, air leaked out around the vent aperture edge. This reduced balloon control and led to a significant increase in burner (and fuel) use to maintain altitude.
• While searching for a suitable landing site at low altitude, control difficulties led to the balloon's basket colliding with 2 buildings.
• While approaching the intended landing area at Elwood Beach, fuel reduced to a level where altitude could not be maintained, and the pilot decided to land the balloon in a suburban street. During the forced landing, the basket collided with terrain resulting in minor injuries to 3 passengers.
• At the request of the operator, the balloon manufacturer had developed and approved a design change to the balloon's deflation system. However, the manufacturer had not conducted the required tests or analysis to ensure the safety of the design change on the balloon (VH-RJR).
• After the design change was approved, the balloon was subjected to the manufacturer’s production inflation test. For reasons that could not be determined, the actual internal envelope air temperature reached during the test was lower than that recorded, and below the minimum required value. The lower temperature achieved during the test reduced the upwards pressure on the vent panel such that the deflation system design issue was not identified.
• The balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests. (Safety issue)

Manufacturer test procedures

Safety issue number: AO-2022-028-SI-01

Safety issue description: The balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests.

Safety action not associated with an identified safety issue

Additional safety action by Kubicek Balloons

Kubicek advised that the flight manual for all balloons has been updated to include a new section which describes the purpose of the temperature sensor and its use during flight (a temperature sensor is optionally fitted to some balloons). At the time of this report, the revised flight manual was awaiting regulatory approval.

CASA               Civil Aviation Safety Authority

CBD                 Central Business District

CoA                 Certificate of Airworthiness

EASA               European Union Aviation Safety Agency

Sources of information

The sources of information during the investigation included the:

• balloon manufacturer
• Bureau of Meteorology
• Civil Aviation Safety Authority
• authorised person for VH-RJR certificate of airworthiness
• balloon operator
• pilot of the incident flight
• passengers
• recorded data from the GPS unit on the aircraft
• video footage and images of the incident flight.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the balloon pilot and operator
• the balloon manufacturer
• Civil Aviation Safety Authority
• the authorised person for VH-RJR certificate of airworthiness
• Civil Aviation Authority of the Czech Republic
• Air Accidents Investigation Institute of the Czech Republic
• European Union Aviation Safety Agency.

Submissions were received from:

• The balloon pilot and operator
• the balloon manufacturer
• Civil Aviation Safety Authority
• the authorised person for VH-RJR certificate of airworthiness.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.