Fuel exhaustion

Safety summary

What happened

On 02 March 2018, at 1549 Western Standard Time, a Skippers Aviation Cessna 441 Conquest, registered VH-LBY, departed on a scheduled passenger service from Fitzroy Crossing to Broome, Western Australia with one pilot and nine passengers on board.

During descent, the FUEL LEVEL LOW annunciators illuminated. The pilot observed that both fuel quantity gauges indicated sufficient fuel remaining and continued flying towards Broome. The right engine began surging, followed by similar surging from the left engine. Subsequently, the right engine lost power and the pilot conducted the engine failure checklist.

The pilot declared a MAYDAY and advised air traffic control that, as the left engine was still operating, the aircraft would be able to reach Broome. However, the left engine also lost power and both engines were unable to be restarted. The pilot landed the aircraft safely on the nearby highway. There were no injuries, and the aircraft was undamaged.

What the ATSB found

Due to water contamination in the fuel tanks, the aircraft’s fuel quantity gauges were significantly over reading on the day of the occurrence and on previous days. The water contamination had existed for some time without being detected by multiple pilots’ fuel quality testing.

Although the pilot routinely compared indicated versus calculated fuel quantities, and indicated versus flight-planned fuel quantities, the pilot did not routinely conduct two other methods stated in the operator’s procedures for cross-checking fuel quantity gauge indications.

In addition, although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications. Pilots also did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified, and pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser.

The FUEL LEVEL LOW annunciators likely illuminated approximately 30 minutes before the fuel was exhausted in each tank, and when the aircraft was still within range of suitable alternative airports. However, the pilot disregarded the annunciations, and relied on the (erroneous) fuel quantity indications and continued to Broome until the engines lost power, at which point a forced landing on a highway was the only remaining option.

What has been done as a result

The operator increased the frequency of a fuel quantity comparison checks to a known quantity to ensure continued quantity measurement accuracy, specified clearer requirements for determining discrepancies when using fuel totaliser figures, implemented additional fuel management record keeping and increased management oversight of its Broome operations. It also increased focus on fuel management procedures during training.

Safety message

Accurate fuel management is a critical aspect of flight operations, and it is important to utilise all available means in order to gain the highest assurance that fuel quantity measurement is accurate. It is essential that a reliable quantity cross-check is adopted, utilising at least two independent methods and a conservative approach. Pilots also should understand the functionality of the low fuel warning system on their aircraft and treat any warning annunciations as being accurate unless there is overwhelming evidence otherwise.

Further reading is available in the ATSB research report, Starved and exhausted: Fuel management aviation accidents (

The occurrence

Previous sectors

On 2 March 2018, Skippers Aviation was operating a twin turboprop Cessna 441 Conquest (C441), registered VH-LBY, on a four-sector scheduled passenger flight from Broome to Fitzroy Crossing, then to Halls Creek, returning via Fitzroy Crossing to Broome, Western Australia. The flight was conducted as a single-pilot operation under instrument flight rules. No significant weather was forecast for Broome and there was a risk of afternoon thunderstorms at the other destinations.

The pilot flew the same aircraft on the previous day. At the end of that day’s flying, the pilot recorded on the aircraft’s flight log that the fuel gauges were indicating a total of 1,300 lb^[1] usable fuel.^[2] Prior to the first flight on 2 March, 600 L (1,050 lb) of fuel was uploaded, which resulted in a calculated fuel on board of 2,350 lb. This amount was sufficient to conduct all four sectors.

After arriving at Halls Creek following the second sector on 2 March, the pilot recorded the fuel quantity gauges as indicating a total of 1,430 lb usable fuel. The pilot stated that the indicated fuel quantities after the first two sectors were consistent with the expected (flight-planned) fuel burns for those sectors. The pilot also reported that the first three sectors were conducted without incident and on schedule.

Prior to departure from Fitzroy Crossing

The aircraft arrived at Fitzroy Crossing after the third sector at 1532 Western Standard Time.^[3] The pilot recorded the fuel quantity gauges as indicating a total of 1,300 lb. This indicated that the fuel burn for the third sector was 130 lb, although the pilot recorded 230 lb on the flight log. The flight-planned fuel burn for the third sector was 357 lb, and the pilot was expecting a fuel quantity indication of about 1,110 lb rather than 1,300 lb.

The pilot’s flight plan estimated 977 lb was the minimum required for the final sector (included reserves). Noting that the indicated fuel quantity (1,300 lb) was above the minimum required according to the flight plan, the pilot did not consider the difference between the expected fuel quantity and indicated quantity any further.

Departure and cruise

The pilot and nine passengers were on board for the last sector from Fitzroy Crossing to Broome (Figure 1).

The pilot reported that, during the taxi for departure at Fitzroy Crossing, the right fuel transfer pump (R X-FER PUMP FAIL) annunciator illuminated momentarily. The pilot attributed this to fuel moving within the tank during the left turn onto the runway from a downward sloping taxiway. The pilot also noticed an imbalance between the quantity indications (left tank higher than right) and selected the right engine crossfeed (both engines supplied from the left tank). The pilot reported that the quantity indications for both sides were similar prior to take-off.

The aircraft departed Fitzroy Crossing at 1549. The pilot reported that the take-off and climb to flight level 260 (FL 260)^[4] were normal.

Figure 1: Aircraft track (just prior to top of climb until landing) and highway

Source: Google Earth, modified by the ATSB

The aircraft reached top of climb at 1607. The pilot stated that, shortly after, the left main boost pump (fuel pump) circuit breaker opened, and the left auxiliary boost pump (L AUX BOOST ON) annunciator illuminated (indicating automatic activation in order to maintain fuel supply). After a short delay to allow the fuel pump to cool, the pilot reset the circuit breaker. The pilot recalled that the circuit breaker opened again, so they conducted the main and auxiliary fuel boost pump failure checklist.

At 1613, the pilot contacted air traffic control (ATC) and advised that the aircraft was maintaining FL 260 at about 90 NM from Broome. ATC cleared the pilot to descend when ready to 7,000 ft. About a minute later, the pilot commenced descent. At this point the aircraft was approximately 27 NM south of Curtin Airport and 42 NM south of Derby Airport (Figure 1).

At about this time, the pilot observed a fuel imbalance (right tank higher than left) that was not consistent with the fuel quantity indications on departure and the fuel flow observed during climb. The pilot selected left engine crossfeed (both engines supplied from the right tank), but the right auxiliary boost pump (R AUX BOOST ON) annunciator did not illuminate as it should for this crossfeed selection. The pilot assessed this as an annunciator fault as the left tank quantity showed an expected increase.

The pilot stated that, during the crossfeed, the R X-FER PUMP FAIL annunciator flickered on and then off, prompting the pilot to stop the crossfeed. The R FUEL LEVEL LOW annunciator then illuminated. The pilot observed that both fuel gauges indicated sufficient fuel to continue to Broome. Shortly after, the R X-FER PUMP FAIL and right fuel pressure low (R FUEL PRESS LOW) annunciators also illuminated. A few minutes later, the corresponding left fuel system annunciators also illuminated.

Engine power losses

The pilot recalled that, soon after the annunciators illuminated, the right engine began surging, prompting the pilot to conduct the partial/intermittent engine power checklist. During the checklist actions, the left engine also started to surge. Following completion of checks for the right engine (with no success), the pilot conducted the checks for the left engine. During this activity, the right engine lost power and the pilot then conducted the engine failure checklist.

At 1623, the pilot contacted the Broome tower controller and declared a MAYDAY.^[5] The aircraft was approximately 47 NM east of Broome at FL 155. By this time, the aircraft was now a similar distance from Derby and Curtin (Figure 1).

At 1627, the tower controller asked the pilot if the aircraft would still be able to reach Broome. The pilot advised that the left engine was still operating, and they would be able to reach Broome. At this time, the aircraft was descending through 10,800 ft and approximately 38 NM from Broome. However, shortly after, the left engine also lost power. The pilot attempted to restart the left engine. It regained power for a brief time before surging and losing power again. Further restart attempts were made on both engines without success.

Diversion and forced landing

With both engines not providing power, the pilot assessed that the aircraft would not reach Broome and they tracked to the south towards the Great Northern Highway in the vicinity of Roebuck Plains.

At 1633, the pilot notified Broome tower of the ‘dual engine failure’ and intentions for the forced landing. The aircraft was approximately 22 NM east of Broome at approximately 4,000 ft. The pilot was unable to extend the landing gear normally and conducted an emergency extension of the gear. Although a passenger brief was conducted, the passengers were not instructed to brace for the emergency landing.

The pilot landed the aircraft safely on the highway approximately 21 NM east-south-east of Broome without injuries or aircraft damage (Figure 1).

After landing, the pilot made radio contact with another aircraft in the area, and the pilot of that aircraft relayed their status and requirements to Broome tower. All passengers were subsequently transferred to Broome via road. The aircraft was towed and secured at a nearby truck stop.

A photo of the fuel quantity gauges taken approximately 1 hour after landing indicated about 1,120 lb fuel on board (Figure 2). Subsequent inspections identified that little or no usable fuel was on board.

Figure 2: Fuel gauges after forced landing

The image shows the fuel gauges indicating a total of about 1,120 lb of fuel on board, about 1 hour after landing on the highway. With the addition of fuel calibration card corrections, the indicated amount should have represented 1,220 lb.

Source: Pilot of VH-LBY following occurrence flight

__________

1. The Cessna 441 Pilot’s Operating Handbook and instrumentation refers to fuel quantity as a weight in lb. The operator specified a conversion factor of 1.74 (1 L equals 1.74 lb). A quantity of 1,300 lb equated to 747 L.
2. Unless otherwise noted, the indicated fuel quantities in this report include the application of fuel calibration card corrections.
3. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8.0 hours.
4. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 260 equates to 26,000 ft.
5. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.

Safety analysis

Introduction

The Cessna 441 (C441) aircraft departed on a scheduled passenger flight from Fitzroy Crossing to Broome without sufficient fuel to reach the destination. This was not identified by the pilot and subsequently the fuel tanks were exhausted and both engines lost power.

Although the weather was suitable for visual flight rules and the aircraft was within range of a highway, the pilot was faced with a dual engine failure, a situation that is not usually addressed in multi-engine training and checking. The pilot successfully landed the aircraft on the nearby highway and there were no passenger injuries or aircraft damage.

A fuel exhaustion event on scheduled passenger transport flight is a serious incident. Accordingly, this analysis will discuss the accuracy of the fuel quantity indication system (FQIS), the procedures and practices used to check the fuel quality, the procedures and practices used to check the fuel quantity, and the effectiveness of the fuel low level warning system.

Fuel quantity indication system error

Post-occurrence inspection of the fuel system identified water contamination of the fuel tanks. The presence of water on the probes had a significant effect on probe functionality, resulting in over reading of the fuel quantity in the tanks. The FQIS functioned appropriately after the water was removed.

More specifically, following the engine power losses and forced landing, the fuel quantity gauges indicated 1,120 lb. On return to Broome, having drained all usable fuel on board, the gauges indicated 740 lb. In addition, prior to the occurrence flight, the gauges indicated about 1,310 lb (after applying fuel calibration card corrections) when there was only about 420 lb of usable fuel on board.

The source of the water contamination could not be definitively determined. It is likely to have occurred at some point during the period 13–26 February, when wingtip damage was being repaired. A review of the aircraft’s flight logs identified that recorded fuel burns after this period were consistently lower than fuel burns prior to this period.

Based on the available information, the water was unlikely to have been introducing during refuelling. It is possible that it was associated with the aircraft sitting in a humid environment for a period of time and, because the tanks were close to empty (about 590 lb total fuel on board), condensation forming in the tank.

It is reasonable to presume that the influence of the water on the fuel quantity gauge indications increased over time. If there had been a substantial step change in the gauge indications (more than the fuel added), then it is likely that this would have been detected when the aircraft undertook a test flight following the repair. However, there was no indication in the flight logs of a substantial discrepancy.

Nevertheless, it is also unlikely that the amount of over reading increased in a linear manner over time. The limited information available suggested that there may have been larger increases in over reading when the fuel levels were lower, which would be consistent with less water on the probes when the fuel tanks were at higher levels. 

Fuel quality management

Considering the level of water contamination found after the occurrence, and the length of time the water had been in the aircraft, it is unclear why this problem had not been detected through fuel quality testing. Fuel drains were required to be conducted by the operator’s pilots prior to the first sector each day and following each refuel. This should have resulted in at least nine inspections prior to the occurrence flight. However, none of these checks appeared to identify an unusual amount of water.

The pilot reported conducting a fuel drain during prior to the first sector on the day of the occurrence but did not report observing water in the fuel and did not test the sample using the water detection capsule. A final opportunity to detect contamination was available following aircraft refuelling. However, the pilot did not conduct a fuel drain and chemical test following the refuel, which reduced the opportunity to detect contamination.

At the time of the occurrence, fuel in the hopper area of each fuel tank of VH-LBY could not be sampled because the standard fuel drains were located elsewhere (including the low points of the fuel system). Although fuel was able to circulate throughout the tank, the hopper was designed to limit the outflow of fuel. As such, it is possible that some fuel samples were not representative of the fuel in the hopper. Nonetheless, not all of the water contamination was found to be in the hopper tanks.

Fuel quantity management

Overview

The operator had several processes in place to check the functionality of the FQIS on its C441 fleet, including several methods that pilots could use to cross-check the fuel quantity gauge indications with other sources.

One reliable and independent method of cross-checking fuel quantity gauge indications is to use some form of direct reading of the fuel quantity; however, no direct reading mechanisms were available for the C441.

Another reliable and independent method of cross-checking fuel quantity gauge indications is to fill the tanks to capacity or to empty the tanks of usable fuel and add a known quantity of fuel. Due to the nature of the operator’s flights, its C441 aircraft were rarely refuelled to capacity during normal operations. However, the operator required each of its C441’s fuel tanks to be refuelled to a known quantity (500 lb per side) every 150 flight hours. Unfortunately, the last check on VH-LBY was done 66 hours prior to the occurrence (and 53 hours prior to the likely start of the FQIS error).

The operator’s fuel management procedures were also supported by regular maintenance inspections to confirm FQIS accuracy. However, in this instance the error had developed in between maintenance inspections.

Ultimately, detecting the FQIS error in this case relied on the operator’s procedures for cross-checking fuel quantity gauge indications, and its pilots use of those procedures.

Check of indicated versus calculated fuel quantities prior to a flight

The primary cross-check method for the C441 fleet specified in the operator’s manuals was a check of the indicated fuel quantity against the calculated fuel quantity (or residual fuel, indicated at the end of the previous flight, plus the refuel amount). This is a relatively simple and commonly used cross-check method in the aviation industry, which can only be used when fuel is added.

However, this cross-check method is not an independent check of the FQIS. It is simply checking the difference in the fuel quantity gauges after fuel has been added. In other words, the check is self-referencing the same source of information. Although it may detect some types of FQIS error, it is generally not adequate to detect gradually developing errors in gauge indications.

The extent to which the method could have been effective on this occasion was difficult to determine because of limitations in the way the C441 pilots were recording information on the flight logs. The operator required pilots to confirm that the difference between the residual quantity recorded on previous flight log and the indicated quantity prior to flight was within 5 per cent of higher amount. After refuelling, pilots were to confirm the difference between the indicated quantity and calculated quantity (sum of residual/indicated plus added fuel) was within 5 per cent. These comparison checks were not recorded, nor required to be recorded. Consequently, pilots were not able to identify any differences or trends in indicated readings over time, or in the indicated versus calculated readings over time.

On the day of the occurrence, the pilot refuelled the aircraft prior to the first sector. The pilot reported that the fuel quantity gauge indications were verified as required before and after refuelling. The residual fuel figure from the previous day was within comparison check limits and therefore carried forward on the flight log, facilitating the continuity of the FQIS error.

Check of indicated versus computed or planned fuel quantities

The operator’s Flight Operations Manual required pilots to compare the indicated fuel with the computed fuel on board (although the manual mistakenly used the word ‘calculated’ instead of ‘computed’). This meant comparing the indicated fuel quantity at the end of a flight with a value based on the indicated quantity at the beginning of the flight and the computed fuel burn during the flight.

In addition, during cruise, C441 pilots were required to compute the destination fuel using current or average groundspeed and current fuel flow, but there was no requirement for this to be recorded. The pilot of the occurrence flight did not appear to use this method, and the extent to which other pilots were using it was unclear.

The operator’s pilots did report that they regularly compared flight-planned fuel burns with recorded fuel burns (based on fuel quantity gauge indications) after each sector. The pilot of the occurrence flight reported that, following each of the first two sectors that day, there was no notable discrepancy between the recorded fuel burns and the flight-planned fuel burns. However, the recorded fuel burn for the third sector based on fuel quantity gauge indications was substantially lower than the expected fuel burn based on the flight plan. Even so, in the absence of relevant information from other sources, the pilot rationalised that this discrepancy was not significant, given that the indicated fuel quantity was significantly more than the minimum required for the flight.

The ATSB noted that there appeared to be significant variability in recorded fuel burns and the associated fuel burn rates, both before and after the FQIS error started. The exact reasons for the size of this variability are not clear, but its effect would be to make it difficult for a pilot to detect when a discrepancy was meaningful. The fuel quantity indications on the aircraft also needed significant corrections from the fuel calibration card, which complicated any calculations. Nevertheless, in the case of the sector prior to the occurrence flight, the discrepancy was substantial and should have prompted further inquiries by the pilot about the fuel quantity indications.

At that stage, the pilot had limited other options available to verify the amount of fuel on board. However, they could have discussed options with a senior pilot or elected to add more fuel.

Check of indicated quantity versus fuel totaliser reading at end of a flight

The operator’s procedures required that C441 pilots enter the indicated fuel on board into the Garmin GNS 530 system at the beginning of each sector, and then compare the fuel quantity gauge indications with the fuel totaliser indication (of fuel on board) at the end of a sector. In effect, this cross-check method, using an independent source, provided a means of detecting whether there was a change in the reliability of the fuel quantity gauges during a flight (or a longer period).

The operator had not specified a threshold level or ‘acceptable amount’ for this check. Accordingly, if a pilot followed the procedure, it was unclear what level of difference between the gauge indications and the totaliser indications warranted action.

More problematically, the procedure was not always being used. The pilot of the occurrence flight reported that they did not think it was mandatory, based on observing other pilots, and did not use it themselves. A senior pilot also agreed it may not have been used regularly by other pilots.

If the pilot of the occurrence flight had used the procedure, then it would have identified a significant discrepancy after the third sector on the day of the occurrence. It is also likely to have detected discrepancies on the two sectors they conducted the previous day. In addition, if the method was being regularly used, it is likely that it would have identified discrepancies on some sectors conducted by the operator’s pilots on previous days.

Check using the X-FER PUMP FAIL annunciators

The operator’s procedures also required that C441 pilots, prior to engine shutdown after a flight, switch the fuel boost pumps off to check whether either of the X-FER PUMP FAIL annunciators would illuminate. If they did, then this meant there was less than 580 lb in that tank. This check was coarse in nature, and would only detect a problem in some cases, depending on the indicated fuel quantity.

Although the procedure was clearly stated in the operator’s operations manual, the pilot of the occurrence flight reported not being aware of this requirement and so was not conducting these checks. Post-occurrence fuel quantity calculations suggests that this gross error check would likely have identified the indication error on arrival at Fitzroy Crossing after third sector and possibly at Halls Creek after the second sector on the day of the occurrence. It is likely it would also have detected a problem after the last sector the previous day.

Summary

In summary, the operator had specified multiple methods for its C441 pilots to use to cross-check fuel quantity indications. However, there were limitations with the design, definition and/or application of these methods. In particular, the primary method used (indicated versus calculated) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications. In addition, the operator’s pilots did not record sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified, and the pilots did not routinely cross-check fuel gauge indications with the information from the independent fuel totaliser.

In the case of the occurrence flight, the pilot had not been applying two of the operator’s cross-check methods (that is, the use of the fuel totaliser and the use of the X-FER PUMP FAIL annunciators). Using either or both of these methods would have identified discrepancies, which should have resulted in the pilot concluding that the FQIS was not functioning correctly.

Low fuel level warning

Illumination of the L/R FUEL LEVEL LOW annunciators on the C441 indicated that 150 to 250 lb remained in the associated tank. This would be approximately 30 to 50 minutes flight time for each engine. The annunciators on VH-LBY were found to be serviceable during post-occurrence inspections and were illuminating at approximately 160 lb remaining in each tank, or roughly 30 minutes flight time.

The fuel level low annunciators are independent of the FQIS and of each other (left and right). Landing as soon as possible would be the most conservative response to a fuel level low annunciation.

Although the pilot reported that the annunciators illuminated in the 10 to 15 minutes prior to the first engine failure, analysis suggests it likely that the annunciators had been illuminated well prior, sometime during the climb. In that timeframe, the aircraft was within range of suitable airports to which a diversion could have been effected.

The pilot considered the FQIS to be reliable but based on experience did not trust the annunciators. As such, the pilot believed there was sufficient fuel on board and continued to Broome and disregarded the fuel level low annunciations. Overall, the pilot’s response to the various fuel system annunciations was consistent with confirmation bias, or a tendency for a person to seek information that confirms or supports their hypotheses or beliefs, and discounting or not seeking information that contradicts those hypotheses or beliefs (Wickens and others 2013). This was likely influenced by not completing all the required fuel quantity cross-checks during previous sectors, resulting in the pilot having little information available (other than the annunciators) to doubt the fuel quantity indications.

Briefing prior to an emergency landing

During the emergency landing, the pilot did not instruct the passengers to adopt the brace-for-impact position.

In a recent cabin safety bulletin, the Civil Aviation Safety Authority (2020) advised:

Passenger survival rates are improved when they are informed about the correct use of equipment and the actions they should take in the event of an emergency, such as how to assume an appropriate brace for impact position.

The brace position has been determined to be the most effective protective position for passengers and crew to adopt to mitigate the potential for injury during impact.

The “brace for impact” position is an action where a person pre-positions his/her body against whatever he/she is most likely to be thrown against, and which may significantly reduce injuries sustained.

The brace position serves two purposes:

1. it reduces flailing by having the forward-facing occupant flex, bend, or lean forward over his/her legs in some manner

2. it reduces secondary-impact injuries by pre-positioning the body, predominantly the head, against the surface that it would otherwise strike during that secondary impact, thus reducing the momentum of the head and other parts of the body.

In summary, because the passengers did not adopt the brace-for-impact position, this increased the risk of injury during the emergency landing. It is likely that the pilot was experiencing a high workload during the approach and emergency landing, but pilots in such situations should ensure, when time is available, that passengers are appropriately briefed for any emergency landing and instructed to brace for impact.

Findings

From the evidence available, the following findings are made with respect to the fuel exhaustion and forced landing involving Cessna 441, VH-LBY, 39 km east‑south‑east of Broome Airport, Western Australia on 2 March 2018.

Contributing factors

• Due to water contamination in the fuel tanks, the aircraft’s fuel quantity gauges were significantly over reading on the day of the occurrence and on previous days. This ultimately resulted in the aircraft departing for a flight without sufficient fuel to reach its destination.
• Although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. These included:
  • The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications.
  • Pilots did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified.
  • Pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser. (Safety issue)
• Although the pilot routinely compared indicated versus calculated fuel quantities, and indicated versus flight-planned fuel quantities, the pilot did not routinely conduct two other methods stated in the operator’s procedures for cross-checking fuel quantity gauge indications.
• The recorded fuel burn for the previous (third) sector based on fuel quantity gauge indications was substantially lower than the expected fuel burn based on the flight plan. However, in the absence of relevant information from other sources, the pilot did not regard this as being an indication of a fuel quantity indicating system problem.
• The pilot disregarded the L/R FUEL LEVEL LOW annunciators, which likely illuminated approximately 30 minutes before the fuel was exhausted in each tank, and when the aircraft was still within range of suitable alternative airports. The pilot relied on the (erroneous) fuel quantity indications and continued to Broome until the engines lost power, at which point a forced landing on a highway was the only remaining option.

Other factors that increased risk

• Although the pilot stated that they conducted a fuel quality check prior to the first flight of the day, they did not conduct another check after refuelling (as required by the operator’s procedures), increasing the risk of undetected fuel contamination.
• The pilot did not instruct the passengers to brace for impact prior to the emergency landing.

Other findings

• Following the complete engine power loss, the pilot assessed the aircraft would not reach Broome Airport, identified a suitable landing area, and conducted a forced landing without injury to the passengers or damage to the aircraft.

Safety issues and actions

Fuel quantity assessment methods

Safety issue number: AO-2018-019-SI-01

Safety issue description: Although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. These included:

• The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications.
• Pilots did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified.
• Pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser.

Safety action not associated with an identified safety issue

Safety action by Skippers Aviation

In April 2021, during the directly involved party process, Skippers Aviation advised that:

• There was a strong focus on Broome as an operating base, with the chief pilot now visiting multiple times per year, and regular audits being carried out.
• Communication between Broome and Perth had been enhanced.
• Emergency procedure training now emphasised brace commands.

Safety action by the Civil Aviation Safety Authority

In the 18 months following the occurrence, the Civil Aviation Safety Authority (CASA) conducted additional surveillance of Skippers Aviation through a series of visits, interviews and observation flights. Surveillance encompassed Airworthiness, Flight Operations, Cabin Safety, Ground Operations and Safety Systems. CASA noted that the operator had demonstrated improvements in the operations of its Broome base and recommended returning to a normal oversight level. No findings were issued on completion of the surveillance.

Sources and submissions

The sources of information during the investigation included:

• the pilot of the occurrence flight
• the operator (Skippers Aviation Pty Ltd)
• the Civil Aviation Safety Authority
• Airservices Australia.

References

Civil Aviation Safety Authority 2020, Cabin Safety Bulletin No.6 – Brace positions, available from www.casa.gov.au.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot of the occurrence flight
• the operator (Skippers Aviation Pty Ltd)
• the Civil Aviation Safety Authority
• Textron Aviation (Cessna).

Submissions were received from:

• the pilot of the occurrence flight
• the operator (Skippers Aviation Pty Ltd)
• the Civil Aviation Safety Authority
• Textron Aviation (Cessna).

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Fuel system schematics

Source: C441 Pilot’s Operating Handbook

Source: C441 Pilot’s Operating Handbook

Appendix B – Fuel system testing procedures

Source: Skippers Aviation Flight Operations Manual

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 5 January 2018, at about 1600 Western Standard Time^[1] the pilot of a Cessna 172M, aircraft registered VH-TUX (TUX) operated by Goldfields Air Services conducted a forced landing into scrubland about 72 km south-south-west of Kalgoorlie Airport, Western Australia. The pilot and one fire spotter were uninjured. The aircraft sustained minor damage.

On 4 January 2018, TUX returned to service following repairs due to significant damage sustained during a storm in January 2017. The repairs involved a bulk strip of the engine, and replacement of the propeller and both wings.

On the morning of 5 January 2018, the pilot returned from a flight in another Cessna 172 around the Kalgoorlie area. The pilot’s next scheduled flight was to conduct fire-spotting operations in the Lake Johnstone area to the south-west of Kalgoorlie (Figure 1).

Figure 1: Location of Kalgoorlie – Boulder airport and overlay of flight paths to fire fronts

Source: Hema- Australia map, flight path overlay by Goldfields Air Services. Annotated by ATSB

The pilot anticipated fire-spotting operations would typically run for two to three hours. The pilot was familiar with TUX and had flown it on numerous occasions over a period of about 18 months prior to its repair and return to service.

At about 1100, the pilot performed a daily inspection and checked the aircraft’s maintenance release. This was the first revenue flight following the repairs and the pilot noted two previous entries from when the aircraft was signed out by the Chief Pilot for check flights prior to its return to service. Apart from the installation of a new propeller, the pilot reported that the aircraft appeared largely unchanged.

During the daily inspection, the pilot dipped the right-hand tank noting the fuel dipstick was graduated in fractions (1/4, 1/2, 3/4 and F) rather than decimal increments in litres as it was when the pilot had flown TUX prior to its return to service. For this flight, the calibration of the dipstick was not important as the pilot had decided to take a full fuel load due to there being only one other person on-board. The pilot recorded a total fuel quantity of 180 litres on board at the start of the flight.

After refuelling, the pilot met with the fire spotter to discuss the flight. During this briefing, the fire spotter identified a second fire front located north-east of Fraser Range that would also require an inspection. The pilot reported that they planned the flight using the OzRunways, electronic flight bag application however, the flight planning requirements detailed in the operations manual were not conducted.

At about 1217, TUX departed Kalgoorlie aerodrome heading east-south-east for the first leg. The aircraft climbed to a cruising altitude of 7,500 ft above mean sea level and continued to a location 232 km from Kalgoorlie. At this location, the pilot descended TUX to between 500 and 1,000 ft above ground level to inspect an active fire front. The pilot circled at that location for approximately 20 minutes before departing to the second location.

The second location was approximately 289 km south-west from the first. The pilot departed the first location and climbed to a cruising altitude of 8,500 ft. Upon arrival at the second location the pilot again descended TUX to between 500 and 1,000 ft above ground level, spending approximately 15 minutes inspecting the second fire front.

The pilot departed the second fire front, climbing to 7,500 ft for the final leg of the flight northward toward the Kalgoorlie aerodrome. At about 1555 at 7,500 ft, the engine speed began to steadily reduce toward idle. The pilot switched between fuel tanks and adjusted the mixture and throttle settings. This resulted in the engine speed momentarily increasing before returning to idle.

The aircraft was about 72 km from Kalgoorlie aerodrome over scrubland. The pilot noticed a dirt road (Burra Rock Road) to the north-west of his current track and prepared TUX and the fire spotter for a forced landing on the road. The pilot made a MAYDAY^[2] call at about 5,000 ft and shortly after activated the Emergency Locator Transmitter (ELT).

As TUX descended below 2,000 ft, the pilot realised the aircraft glide range would be insufficient to land on the road. The pilot identified an area of less dense scrub and landed TUX, coming to a stop approximately 30 m from the Burra Rock Road with minimal damage. Both pilot and fire spotter exited the aircraft with no injury. The pilot was unable to make contact by VHF radio^[3] or mobile phone at the landing site so they walked about 1 km to Burra Rock Main Dam where mobile phone reception was possible.

At about 1600, the Australian Maritime Safety Authority contacted the operator and requested their assistance to undertake a search and rescue flight to the ELT location. Shortly after, the search aircraft arrived at the location and held overhead until emergency services attended the site at about 1700.

Fuel management

Fuel system

The Cessna 172M utilises a gravity feed fuel system from a fuel tank mounted in each wing. Both wings on TUX had been replaced during the recent repairs, with wings from another Cessna 172M. However, the replacement wings were fitted with smaller capacity tanks, which reduced the useable fuel capacity from the original 182 litres to 144 litres. A fuel gauge calibration check was performed on 21 December 2017 and a fuel calibration placard was affixed to the centre of the instrument panel. Fuel quantity labels were also placed adjacent to the fuel filler caps indicating the respective tank’s fuel capacity (Figure 2).

Figure 2: Fuel placard and label installed on VH-TUX

Source: Goldfields Air Services

A hand written entry dated 22 December 2017 adjacent section 1.3 Fuel in the Pilots Operating Handbook recorded ‘Wings replaced, fuel capacity 144 litres, Refer PenYan Supplement^[4] for fuel consumption data.’

Accurate fuel determination

Prior to the fire spotting flight in TUX, the pilot dipped the right tank which indicated about 3/4 full on the dipstick. The pilot did not dip the left tank, as the intention was to fill the tanks before departing for the flight. The pilot uploaded a total of 45.9 litres of fuel between the two tanks. The pilot stated the fuel quantity uploaded was consistent with his expectation, based on previous experience with TUX, to fill the tanks on this aircraft.

The pilot did note that the dipstick was graduated in quarters, rather than in decimal increments (litres). He considered that these markings when used to determine the fuel quantity remaining was not optimal as it potentially made it more difficult for a pilot to check actual fuel (in litres) remaining in the aircraft, if departing with less than full tanks (Figure 3).

Because TUX had just returned to line following evaluation flights post repair, no Trip Sheet^[5] was available in the aircraft to indicate recent fuel usage history. The pilot raised a new Trip Sheet and recorded a fuel upload of 46 litres and that the total fuel on board at start-up was 180 litres.

Figure 3: Fuel dip sticks from Cessna aircraft TUX and CAL

Image of fuel dipsticks from the incident aircraft VH-TUX (left) and the aircraft VH-CAL (right) flown by the pilot earlier on the morning of 5 January 2018.
Source: Goldfields Air Services, annotated by ATSB

Flight planning

The pilot checked weather conditions for the flight which were ideal (CAVOK)^[6] for the rest of the day. To determine the time available at each location, the planned flight paths to the fire front locations were calculated using the OzRunways application and Jeppesen circular slide rule. Based on previous experience in flying TUX, the pilot determined that with full fuel tanks, there was a flight time of 4 hours available from when they took off, which would give about 15‑20 minutes at each fire location for the inspections. The pilot’s methods for planning the flight were inconsistent with the operator’s standard operating procedures and instructions.

In-flight fuel management

The cruise sections of the flight were undertaken at 2,500 RPM, to run the engine in following the rebuild. The pilot climbed to 7,500 and 8,500 ft and leaned the mixture. The pilot had noted the departure time and estimated time of arrival to ensure the flight could be completed within the calculated fuel endurance. The pilot periodically checked the fuel gauges^[7] during the flight, which were indicating a steady decrease as the flight progressed. As TUX approached the second fire front located in the Lake Johnston area, the pilot noticed the gauges were indicating lower than he would have expected but discounted the lower than expected indication on the basis of his calculated fuel endurance.

The pilot reported that he had one fuel gauge indicating around 5 US gallons and the other around 2 US gallons when the engine reduced to idle and ceased producing power. The pilot did not recall which gauge provided the respective indications.

Operator’s report

The operator conducted their own investigation of the occurrence circumstances. Their investigation report listed a number of applicable standard operational procedures that specified the minimum requirements for pre-flight preparation, planning and in-flight fuel management for the intended operation type. These procedures required a pilot to ensure the documentation of flight plans, weather briefings and other information prior to departure. With the exception of the Trim and Trip sheets, there was no evidence of a documented flight plan, weather information, or a navigation log completed by the pilot.

The operator utilised flight planning software, which contained the approved performance data for each aircraft, including fuel consumption. As part of their internal investigation, post‑incident flight planning calculations were undertaken using this software as well as the actual fuel consumption during the occurrence flight. Those calculations indicated that TUX did not have the available fuel capacity, even if fitted with the original larger fuel tanks, to complete the intended flight with the operator‑required fixed fuel reserve of 45 minutes^[8].

Aircraft inspection

On 6 January 2018, the operator’s maintenance personnel inspected and commenced recovery of TUX from the landing site. The aircraft was powered-up and the gauge for the left wing tank was observed to indicate a reading equating to approximately 10 litres of fuel in the tank. There was no record in the operator’s report of the indication on the right tank gauge. The fuel was drained from the wing tanks and fuel system strainer yielding about 200 mL in total (around 25 mL from the tanks and 150 mL from the fuel strainer).

On 9 January 2018 following the recovery of TUX, the operator’s maintenance personnel reconnected the fuel gauges and found both gauges indicated empty. Although the wing was not fitted to the fuselage, 30 litres of fuel was added and drained from the left wing tank to check the correspondence of indications on the left tank gauge. With fuel added, the gauge indicated just under the half-full mark. After draining the fuel, while tapping the wing to simulate normal vibrations during flight, the gauge returned to indicate just below empty. Although this test did not take into account unusable fuel, the operator considered these indications were within expectation for the quantity of fuel added, and the fuel transmitter was found to operate smoothly across the full range checked.

On the 12 January 2018 the engine of TUX was started with no roughness at idle evident. After warming, the engine was accelerated up to maximum ground RPM. The engine accelerated smoothly with no abnormal sounds and oil pressure and exhaust gas temperature indicated a normal reading.

Operator communication with pilots

The operator’s chief pilot communicated to line pilots either verbally, by e-mail, or through the Alerts feature of the operator’s Air Maestro Safety Management System software. The Air Maestro system was primarily used to formally disseminate information related to scheduling, rosters, safety reports and new operational alerts or notifications. The operator acknowledged an omission occurred in the dissemination of information, which resulted in no operational alert/notification being published on Air Maestro in relation to the change in the useable fuel capacity or upgraded engine for TUX.

The aircraft was equipped with a folder containing the maintenance release, the manufacturer’s pilot operating handbook, weight and balance data and aircraft supplements. The pilot’s operating handbook for TUX included handwritten amendments by the chief pilot in the fuel section. The amendments were dated 22 December 2017, recording the aircraft wings had been replaced and the fuel capacity of 144 litres. Reference was also included to refer to the Pen Yan flight manual supplement for fuel consumption data associated with the newly‑installed engine.

Safety analysis

While the pilot conducted his pre-flight planning activity, it was not consistent with the regulatory requirements for flight planning and preparation, or the operator’s electronic flight bag administration and in-flight fuel management procedures. Consequently, the pilot did not identify that, even if it had been fitted with the original larger fuel tanks, the aircraft had insufficient endurance to safely conduct the flight.

The pilot’s pre-flight planning was based on the expectation that the aircraft’s endurance would be 4 hours after departing Kalgoorlie. This was consistent with the pilot’s belief that the useable fuel capacity and fuel consumption of TUX was unchanged from the 182 litres available when the pilot operated the aircraft before its removal from line in January 2017. The pilot did not detect the change to the flight manual or the fuel tank capacity displayed on the cockpit fuel calibration card or tank placards installed following the installation of the new wings and calibration of the fuel system. Additionally, because this was the first flight of TUX following return to service, there was no available information available from a Trip Sheet, to provide an indication to the pilot that the fuel capacity had reduced.

During the fight, the pilot observed a steady decrease in the indications on the fuel gauge. Although the indications appeared lower than expected at the second fire front location, the pilot discounted the accuracy of the indications. The pilot’s in-flight fuel management was likely also based on the expectation of the aircraft’s endurance, rather than crosschecking the expected fuel burn against the fuel burn achieved during flight at the 30-minute intervals required under the operator’s standard operating procedures.

The change to the aircraft’s total fuel tank capacity (and corresponding reduction in the aircraft’s endurance) was not formally published in the operators Air Maestro Safety Management System to alert line pilots of the significant modification to the aircraft prior to its return to line on the 5 January 2018.

The absence of information alerting pilots to the change in the aircraft’s endurance and the pilot’s pre-flight fuel management planning (based on an expectation), meant that there was insufficient fuel available for the intended flight. Furthermore, pilot’s in‑flight fuel management resulted in the aircraft exhausting its useable fuel supply about 3 hours and 38 minutes into the flight with the aircraft about 72 km from the intended landing point.

When the engine began to reduce power, the pilot’s experience from instructing student pilots on the protocols for an engine restart and practice forced landings likely aided in managing workload during the emergency and led to the successful forced landing.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The pilot's fuel management practices resulted in a complete loss of engine power due to fuel exhaustion that led to a forced landing in scrubland.
• The aircraft's reduced fuel capacity was not adequately communicated to the pilot in accordance with the operator’s standard practices.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Goldfield Air Service conducted an internal review to:-

• determine incidence of deviation within the pilot group from the implementation of standard operating procedures
• examine the operator’s change management plan to determine, at an organisational level, why the effect of the changes to the aircraft configuration were not fully captured and broadcast to all operating crews.

Safety message

Fuel starvation and exhaustion events continue to be reported to the ATSB. It is therefore important for pilots to continue to educate themselves on the risks and controls associated with fuel management.

Methods for cross-checking fuel on board before flight are published by the Civil Aviation Safety Authority in Civil Aviation Advisory Publication 234-1(2): Guidelines for aircraft fuel requirements.

Case studies for pilots to learn about fuel management related accidents have been published by the ATSB in Avoidable Accidents No. 5 – Starved and exhausted: Fuel management aviation accidents.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
3. Very High Frequency - radiophone
4. Prior to the January 2017 storm damage, the aircraft was fitted with an upgraded Penn Yann Aero 180 HP engine.
5. Operator’s document carried with the aircraft to record pre-flight details of flight date, pilot, tacho/VDO time out/in and quantities of fuel on board at start-up and shutdown, together with any fuel uploaded to the aircraft.
6. Ceiling and visibility OK for Visual Flight Rules.
7. Fuel gauges of TUX indicated quantity in both the fraction of tank capacity and US Gallon increments.
8. Civil Aviation Advisory Publication 234-1 (1)

What happened

On the morning of 15 June 2017, the pilot of a Beech 58 aircraft, registered VH-PBU, operated by Savannah Aviation, contacted a refueller at Mount Isa Airport, Queensland (Qld) and requested 400 L of fuel be added to the aircraft. The pilot then left the airport and was not present for the refuelling. The refueller attended the aircraft and provided 200 L of fuel. After the refuelling, the refueller completed a fuel delivery receipt (Figure 1). On this delivery receipt the refueller recorded fuel meter readings starting at 3,727 L and finishing at 3,927 L, a difference of 200 L. The refueller recorded the amount provided as 400 L and placed a copy of the delivery receipt through an aircraft window. The refueller then left the aircraft prior to the pilot returning.

After returning to the airport, the pilot of the aircraft collected the fuel delivery receipt and noted 400 L as the quantity listed. However, the pilot did not cross-check the meter readings recorded on the delivery receipt to verify the amount provided. The pilot recorded 400 L of fuel being added in the aircraft fuel log and calculated the total fuel on board to be 570 L. The pilot then cross-checked the fuel added by observing that the fuel gauges had risen since the last flight. The combined fuel capacity of the aircrafts main tanks was 628 L. The pilot then completed two short flights.

Figure 1: Extract of fuel delivery receipt

Source: Queensland Police Service

At the end of the day, the refueller totalled the daily fuel delivery quantities and detected a 200 L discrepancy between the recorded deliveries and the meter readings. The refueller identified that the discrepancy was due to an error in the refuelling of VH-PBU. The refueller immediately went to the aircraft to notify the pilot of the error, however the refueller was not able to locate the pilot. The refueller was then distracted by a phone call and forgot about the refuelling error.

On 19 June, the aircraft was ferried from Mount Isa to Burketown Airport, Qld.

On 20 June, a second pilot conducted a passenger charter flight in the aircraft from Burketown. As this pilot prepared to depart on this flight, a passenger commented on the low fuel level indicated on the aircraft fuel gauges. The pilot reviewed the fuel log which showed 332 L on board. The pilot then cross checked the fuel log calculations against the fuel gauges and was satisfied that the calculations were correct. After the flight, this pilot contacted the pilot who had organised the previous refuelling to confirm that the amount of fuel on board the aircraft was consistent with that in the fuel log. The refuelling pilot confirmed that the amount should be correct. The second pilot conducted three more flights that day. After the second flight, a further 100 L of fuel was added to the aircraft.

On the morning of 26 June 2017, the second pilot prepared to conduct a ferry flight in the aircraft from Burketown to Normanton Airport, Qld. The pilot checked the fuel log which showed 248 L to be on board the aircraft. At about 0815 Eastern Standard Time (EST), the flight departed Burketown, the pilot was the only person on board. The take-off and climb were uneventful.

About 10 NM north of Normanton, the aircraft descended through about 3,500 ft above mean sea level. At this time, the right engine began to surge and the pilot observed fluctuations in fuel flow for the right engine. The pilot selected the right engine low pressure fuel boost pump to on, however, the surging continued. The pilot then used the fuel selector to cross-feed fuel from the left fuel tank to the right engine. After selecting cross-feed from the left main tank, the surging stopped and the right engine resumed normal operation.

About 20 to 30 seconds after selecting cross-feed, both engines began surging. The pilot selected the high-pressure fuel boost pumps on for both engines, selected mixture to full rich, advanced the propeller control and advanced the throttles. As the aircraft descended through about 2,000 ft, the engines continued surging. About 20 to 30 seconds later, both engines failed.

After the engines failed, the pilot feathered^[1] both propellers. The pilot determined that the aircraft had insufficient energy to glide to Normanton Airport and selected a clear paddock as suitable for a forced landing. The pilot observed a powerline on the southern boundary of the paddock and left the landing gear retracted until they were assured the aircraft would clear the powerline.

After determining that the aircraft would clear the powerline, the pilot lowered the landing gear and landed in the field. During the landing roll the aircraft impacted a number of bushes.

The pilot was not injured during the incident, however, the aircraft sustained substantial damage (Figure 2).

Figure 2: Damage to right wing

Source: Queensland Police Service, annotated by ATSB

Operator refuelling procedure

The operator’s operations manual contained the following guidance on recording fuel uplift following refuelling:

The crew member supervising refuelling is to note the fuel meter readings before and after fuel delivery and confirm that the correct amount is entered on the fuel record.

Beech 58 fuel system and management

Accurate fuel determination

Due to the design of the main fuel tanks, unless the tanks were full, it was not possible to determine fuel quantity in each tank by visual inspection or through the use of a dipstick. The exact quantity of fuel on board could only be determined when the tanks were filled. Fuel quantity was therefore estimated through the use of a fuel log.

Fuel usage calculations

The operator specified a cruise fuel flow rate of 128 L/hr for the aircraft, a cruise-climb fuel flow rate of 160 L/hr and an allowance of 10 L for engine start and taxi. Company pilots used these figures to calculate the amount of fuel used during flight and deducted this amount from the fuel on board at the start of the flight to calculate current fuel on board. After refuelling, the amount uplifted was added to the fuel log prior to the next flight.

Fuel calibration card

The pilots crossed-checked the fuel log against the aircraft fuel gauges to determine the accuracy of the fuel log calculations. To assist with this check, the aircraft had a fuel calibration card. The data for this card is compiled during maintenance, the aircraft is fuelled with known amounts and these amounts are checked against the aircraft gauge readings in order to calibrate the gauges. The results are recorded on the card. The fuel calibration card is mounted on the instrument panel immediately adjacent to the fuel gauges.

Figure 3: VH-PBU fuel calibration card

Source: Operator

The Beech 58 also provides external fuel gauges for the main tanks mounted on the wings. The use of these gauges is not specified in the operations manual. Company pilots did not use the external fuel gauges to verify fuel log calculations.

Guidelines for aircraft fuel requirements

The Civil Aviation Safety Authority advisory publication,

Unless assured that the aircraft tanks are completely full, or a totally reliable and accurately graduated dipstick, sight gauge, drip gauge or tank tab reading can be done, the pilot should endeavour to use the best available fuel quantity cross-check prior to starting. The cross-check should consist of establishing fuel on board by at least two different methods.

Refuelling pilot comments

The pilot who requested the refuelling on 15 June provided the following comments:

• It would be beneficial to be present when the aircraft is being refuelled. In addition, more diligence should be taken to cross-check the meter readings when reviewing the fuel delivery receipt.
• There were opportunities over the days following the refuelling error for the error to be communicated, however, this did not occur.
• The fuel gauges in the aircraft generally showed an indication of full when the aircraft was loaded with more than three-quarters of tank capacity. After the refuelling on 15 June, the gauges indicated about three-quarters full, therefore the refuelling pilot believed the amount of fuel on board matched the amount calculated in the fuel log.

Forced landing pilot comments

The pilot who was in command of the aircraft at the time of the forced landing provided the following comments:

• The normal method of verifying the accuracy of the fuel log was to cross-check against the fuel gauges. The only other way to accurately determine the fuel on board was to completely fill the main fuel tanks. The operator had no set schedule for filling the main fuel tanks to verify the accuracy of the fuel log. Filling the tanks to full only occurred when required by flight planning requirements.
• Prior to the incident flight, the fuel gauges indicated about a quarter full. The pilot calculated that the flight from Burketown to Normanton would use about 80 L of fuel.
• In normal operations, the right main fuel tank fed fuel to the right engine and the left main fuel tank fed fuel to the left engine.
• The company operated a number of Beech 58 aircraft. The fuel indication calibrations were different in each aircraft. The pilot had not flown PBU regularly, and therefore was not familiar with the fuel gauge readings expected for different fuel loads in this aircraft. The aircraft contained a fuel gauge calibration card (Figure 3) which was only a general guide as to the fuel quantity indication.

Previous occurrence

A review of the ATSB database identified a previous fuel related event involving a Beech 58 aircraft: Fuel related event involving Beech BE58, VH-ECL, 111 km E of Tindal Aerodrome, NT on 14 August 2013. The incident is summarised below:

ATSB investigation AO-2013-131

On 14 August 2013, the pilot of a Beech BE58 aircraft, registered VH‑ECL, was preparing for a charter flight from Tindal to the Borroloola aeroplane landing area, Northern Territory.

Using the operator’s elected fuel flow rate for the aircraft of 125 L/hr, the pilot calculated that a minimum of 545 L of fuel was required. The pilot elected to carry 570 L. In preparation for the flight, the pilot referenced the fuel log, which indicated that about 267 L of fuel was on board the aircraft. Consequently, the pilot refuelled the aircraft, adding about 153 L into each of the main fuel tanks.

During the cruise, the pilot observed the fuel quantity gauge for the right main fuel tank reading zero, but the fuel flow, and engine temperature and pressure indications were normal. The aircraft landed at Borroloola and the passengers disembarked. The pilot re‑checked the fuel calculations and determined that there was sufficient fuel on board for the return trip. The pilot noted that the right fuel quantity gauge was still reading zero and the fuel quantity gauge for the left main tank was indicating about three-quarters full.

On the return flight, when about 50-60 NM from Tindal, the right fuel flow gauge dropped to zero. The pilot shut down the right engine, notified air traffic control and conducted a single-engine landing at Tindal.

This incident highlighted the importance of establishing known fuel status regularly and the need to use multiple sources to determine fuel quantity. This is particularly important for determining accurate fuel flow rate calculations and when the fuel quantity on board can only be accurately determined when the fuel tanks are full.

Safety analysis

On 15 June 2017, the aircraft was refuelled with 200 L of fuel, however, 400 L was recorded as being delivered. The pilot did not detect the discrepancy in the fuel delivery receipt and added 400 L to the aircraft fuel log.

The refuelling procedures did not require a cross-check to verify the amount of fuel provided and the error was not detected by the refueller until the end of the day. While an attempt to communicate this error was made, ultimately it was not communicated to the pilot or the operator.

Over the next 11 days, the aircraft completed a number of flights operated by both pilots without the discrepancy between the calculated and actual fuel on board being detected.

Prior to the flight on 26 June, the fuel log showed the aircraft as having 248 L on board. The pilot verified this value using the aircraft fuel gauges which indicated the tanks were about one quarter full. At this time, the actual fuel on board would have been about 48 L. The fuel calibration card indicated that for a reading of about one quarter full, the actual fuel on board should be 170 L. This indication corresponds more closely to the calculated fuel on board (248 L) than the actual amount of fuel likely to have been on board the aircraft at that time (48 L) and may have reinforced the pilot’s assumption that the fuel log calculation was correct.

The aircraft departed Burketown with insufficient fuel to complete the flight to Normanton. As the aircraft descended towards Normanton, the quantity of fuel in the right main tank was exhausted and the right engine began to fail. The pilot was able to keep the engine running momentarily by cross-feeding fuel from the left main tank. Shortly after selecting cross-feed, the quantity of fuel in the left main tank was also exhausted and both engines failed.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The refueller recorded 400 L on the fuel delivery receipt when only 200 L had been provided. The refuelling procedures did not contain a cross-check to verify the amount of fuel provided and this error was only detected by the refueller at a later stage. The error was not communicated.
• The refuelling pilot did not detect the discrepancy in the fuel delivery receipt and recorded an incorrect amount of 400 L added fuel in the fuel log. Over subsequent flights the discrepancy between the calculated and actual fuel on board was not detected by either pilot.
• The engines failed due to fuel exhaustion.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Fuel provider

As a result of this occurrence, the fuel provider has advised the ATSB that they are taking the following safety action:

Change to procedure

• The fuel delivery procedure has been amended so that pilots must now review and sign the fuel delivery receipt after receiving fuel.

Safety message

This incident underlines the importance of communication once an error has been discovered. The refuelling error was discovered 11 days prior to the incident flight, however, this was not communicated to the operator or pilots. Knowledge of the error would have enabled the pilots to correct the fuel log and avoid the incident.

Accurate fuel management is critical to the safe operation of an aircraft. The ATSB publication Avoidable Accidents No. 5 - Starved and exhausted: Fuel management aviation accidents provides the following key messages:

Accurate fuel management starts with knowing exactly how much fuel is being carried at the commencement of a flight. This is easy to know if the aircraft tanks are full or filled to tabs. If the tanks are not filled to a known setting, then a different approach is needed to determine an accurate quantity of usable fuel.

Accurate fuel management also relies on a method of knowing how much fuel is being consumed. Many variables can influence the fuel flow, such as changed power settings, the use of non-standard fuel leaning techniques, or flying at different cruise levels to those planned. If they are not considered and appropriately managed, then the pilot’s awareness of the remaining usable fuel may be diminished.

Keeping fuel supplied to the engines during flight relies on the pilot’s knowledge of the aircraft’s fuel supply system and being familiar and proficient in its use. Adhering to procedures, maintaining a record of the fuel selections during flight, and ensuring the appropriate tank selections are made before descending towards your destination will lessen the likelihood of fuel starvation at what may be a critical stage of the flight.

Aviation Short Investigations Bulletin - Issue 62

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.

The aircraft departed Denham for travel to Perth via a refuelling stop at Geraldton.

At about 0806 hours the aircraft crashed approximately 770 metres, bearing 347°M from the threshold of runway 21 at Geraldton, apparently out of control and with the stall warning audible throughout the final radio transmission.

Investigation Indicated that both engines had stopped prior to Impact due to fuel exhaustion. There were no Indications of fuel leaks, and an analysis of times flown by the aircraft preceding the crash revealed that the available fuel should have been exhausted at about the time the engines were reported to have stopped. Fuel was available at Denham but, for unknown reasons, was not utilised by the pilot.

The pilot did not lodge a flight plan with the Civil Aviation Authority nor was any evidence found in the wreckage to Indicate that the pilot had used a flight plan or fuel log enroute. No conclusive determination for the loss of control of the aircraft was reached, however, the proximity to the threshold of runway 21 and the configuration of the aircraft with the wheels down, suggests that the pilot may have been attempting to turn towards that runway for a glide approach and landing.

SIGNIFICANT FACTORS

The following factors were considered relevant to the development of the accident:

1. The aircraft departed Denham with Insufficient fuel for the flight to Geraldton.
2. The pilot was apparently unaware that the fuel state was Inadequate and did not refuel at Denham.
3. Both engines stopped due to fuel exhaustion.
4. Control of the aircraft was lost at a height which did not allow the pilot to recover.

What happened

On 17 July 2016, at about 1039 Central Standard Time, a McDonnell Douglas Corporation 369D helicopter, registered VH-PLY, experienced fuel exhaustion and a collision with terrain while performing powerline inspections 36 km north-west of Hawker, South Australia. There were three crew on board the helicopter. One pilot in the front left seat, one line-worker in the front right seat and one line-worker in the rear left seat. The three crew members were seriously injured, and the helicopter was substantially damaged.

What the ATSB found

The ATSB found that ground staff mistakenly told the pilot that the aircraft had been refuelled and through distraction, omitted a crosscheck of the fuel quantity before flight. The pilot’s monitoring of the fuel in-flight was based on anticipated endurance, which resulted in him not detecting a low fuel level.

The helicopter was operating with an auxiliary fuel tank system, which did not include a fuel quantity indicator. The Civil Aviation Safety Authority and Design Approval Holder provided responses to the ATSB, which indicated that a misunderstanding likely occurred during the design review and approval process. This resulted in the auxiliary fuel tank system approval migrating from the restricted category to the normal category without a fuel quantity indicator.

The ATSB also found the requirements for the development of fuel policy by operators were dispersed throughout the aviation legislation—14 legislative and three guidance material requirements were found—but they did not require the operator to publish procedures for determining fuel on board before and during flight for commercial operators of aircraft less than 5,700 kg maximum take-off weight.

What's been done as a result

The operator immediately removed all auxiliary fuel tanks from their helicopter fleet and restricted their powerline patrols and inspection flights to main fuel tank fuel only. They developed a corrective actions plan, which included modifications to the auxiliary fuel tank system; permanent installation of a remote warning device; and amended their operations manual to include prescriptive fuel check instructions.

To provide clarity for fuel policy requirements for pilots and operators, in 2016 the Civil Aviation Safety Authority initiated a project to change the fuel regulations and guidance material. The Civil Aviation Amendment (fuel and oil requirements) Regulations 2018 are planned to be implemented in November 2018 as CASA 29/18 – Civil Aviation (Fuel Requirements) Instrument 2018.

The ATSB has issued a Safety Advisory Notice (AO‑2016‑078‑SAN-009) for Air Operator Certificate holders of aircraft not greater than 5,700 kg regarding fuel management.

Safety message

This accident highlights the importance of crosschecking fuel before flight and in-flight fuel monitoring by pilots to prevent fuel exhaustion accidents. It also highlights the potential consequences of distraction breaking the flow of ongoing activities. In this case, it resulted in the fuel quantity of the auxiliary fuel tank not being visually checked prior to flight. After recognising that a distraction has occurred, it is crucial that pilots re-establish situation awareness.

Operators of aircraft not greater than 5,700 kg maximum take-off weight are advised they can reduce their risk of a fuel exhaustion accident by providing published procedures and crew training for crosschecking fuel on board before and during flight.

The occurrence

On 17 July 2016, at about 1039 Central Standard Time,^[1] a McDonnell Douglas Corporation 369D helicopter, registered VH-PLY, collided with terrain after experiencing fuel exhaustion while performing powerline inspections 36 km north-west of Hawker, South Australia (Figure 1). There were three crew on board the helicopter. One pilot in the front left seat, one line-worker (data recorder) in the front right seat and one line-worker (inspector) in the rear left seat. The three crew members were seriously injured, and the helicopter was substantially damaged.

Figure 1: VH-PLY accident site

Source: South Australian Police

On 16 July 2016, two powerline inspection flights were recorded in the helicopter flight log (involving the same crew as the accident flight). The first flight was from 0830 to 1130. It started with 350 L of fuel and ended with 40 L. The helicopter was then refuelled from an intermediate bulk container.^[2] As recorded by the pilot on the flight log, the second flight, conducted from 1206 to 1406, started with 350 L of fuel and ended with 170 L of fuel.

On the next day, the crew started their duty at about 0800. They arrived at Port Augusta Airport at about 0814 where they conducted pre-flight checks of the helicopter and established contact with the customer for permission to access the powerlines, and completed the on-site safety management form. The pilot reported he requested full fuel from the operator’s ground support person who replied that he had refuelled the helicopter the day before.

The pilot was observed by other team members performing fuel quality checks during the pre-flight inspection, but was not observed conducting fuel quantity checks. The pilot reported he was approached by another helicopter crew at the airport while conducting his pre-flight inspection, which interrupted his inspection and resulted in him omitting a visual fuel quantity check of the helicopter’s auxiliary fuel tank (see the Helicopter fuel system modification section in this report).

The ground support person departed the airport with the intermediate bulk container at about 0834 to travel to the planned refuel location with a 3-hour SARTIME^[3] for the helicopter, nominated by the pilot. Before engine start, the pilot was observed performing his normal scan of the instruments and reported to the ATSB that he thought the fuel quantity indicator indicated full. The helicopter departed the airport at about 0849.

The first phase of their task was a ferry flight to a small transmission substation. They arrived at the substation at about 0923 and started their inspection. The pilot reported that at about 50 minutes into the flight he activated the auxiliary fuel tank solenoid valve to start the gravity transfer of fuel from the auxiliary fuel tank to the main fuel tank. He could not recall if he checked to confirm there was fuel transferring.

At about 1035, the helicopter arrived at powerline structure 228 to perform an inspection. The pilot reported that at a height of about 100 ft, as the helicopter started to move from structure 228 to 229, the engine ‘just stopped’. The pilot veered the helicopter away from the powerline towards a clear area, called ‘brace’, but was unable to arrest the rate of descent, resulting in a collision with the terrain.^[4]

The line-worker data recorder regained consciousness in the helicopter and activated the Spidertracks^[5] emergency signal at 1039. The line-worker inspector regained consciousness and found himself outside of the helicopter attached to his harness. The harness was still attached to the helicopter. Neither of the line-workers were able to walk or assist the pilot. The pilot was unable to extricate himself from the helicopter and was eventually removed by the first responding police officer.

Helicopter fuel system inspection

The ATSB inspected the wreckage after it was removed to Port Augusta and spoke to the first responders whom attended the accident site. The ATSB investigation identified:

• no post-impact fire
• no smell of fuel in the wreckage
• no evidence of entrapped fuel within the wreckage
• no usable fuel in the main tank fuel bladder
• main tank bladder was intact and the only identifiable puncture mark was at the top of the bladder and considered to be the result of the impact
• no residual fuel in the fuselage cavity housing the fuel bladder
• minimal fuel found in the airframe and engine fuel filter bowls
• auxiliary fuel tank was empty
• the fuel indicator, showing low fuel level, and fuel transfer systems were found to be serviceable.

The ATSB also established the helicopter was not refuelled after the second flight on 16 July and the accident flight on 17 July.

Helicopter fuel system modification

The operations manual fuel policy indicated the helicopter had a main fuel tank capacity of 242 L and auxiliary fuel tank capacity of 115 L (total of 357 L). Fuel consumption was published as between 100 L/h for patrolling and 120 L/h for prolonged high hover.

The operator’s fleet of McDonnell Douglas 369 helicopters have had several modifications incorporated,^[6] which included the auxiliary fuel tank (Figure 2).

Figure 2: Auxiliary fuel tank fitted to VH-PLY

The auxiliary fuel tank was manufactured from stainless steel. It had a volume of 125 L, but a specified capacity of 115 L when filled to the bottom of the filler neck. The tank was located in the rear right side of the cabin. Fuel transfer was controlled by the pilot operating the solenoid valve switch, located on the instrument panel, marked ‘AUX. FUEL TRANSFER’. A green indicating light, located next to the fuel transfer switch would illuminate when the switch was selected to the transfer position. When selected, fuel would gravity drain from the auxiliary tank to the main tank. The main fuel tank provided the fuel supply to the engine.

The pilot reported the transfer of fuel from the auxiliary to the main tank could be verified by the fuel quantity indicator needle not moving, as the fuel would gravity transfer at about the same rate as the engine consumed fuel. He normally activated the fuel transfer switch at about 200–250 lbs (110–130 L) fuel remaining, or 50 minutes of flight time. The pilot reported that he was always taught not to trust fuel quantity indicators and he would therefore manage the helicopter’s endurance ‘on the clock’.^[7]

The auxiliary fuel tank system did not include a fuel quantity indicator or sight glass or dip stick to check the fuel quantity. Only the main fuel tank system incorporated a fuel quantity indicator. The pilot reported that the auxiliary fuel tank quantity would normally be visually checked by removing the fuel cap before flight, but could not explain how the quantity was verified by a visual check if the tank was filled to less than full.

The pilot reported the decision to use the auxiliary fuel tank was based on the proposed length of the task and the environmental conditions. If no more than two hours of fuel was required or the helicopter performance would be marginal with the extra weight of fuel on board, then the auxiliary fuel tank would not be filled. A review of VH-PLY’s flight logs for the week prior to the accident indicated the auxiliary fuel tank was routinely used during powerline inspections.

The ATSB received two separate independent reports during the course of the investigation that the auxiliary fuel tank was routinely used for flying operations, which included flying training. The reports included the practice of managing fuel endurance ‘by the clock’ with the auxiliary fuel tank.

Design advice

The auxiliary fuel tank design, installation and use started in 1993. The approval holder of the design (the design organisation) changed three times from 1993 to the accident date. Several Design Approvers (CAR 35 authorised persons working for the approval holder) were involved in the various iterations of the tank design and associated documentation. None of those approvers were employed with the current approval holder at the time of the investigation. As a result, historical documents and professional judgement were relied upon, by the design organisation, to provide responses to ATSB questions.

The auxiliary fuel tank design was originally approved in 1993, which required operations to be conducted under a special flight permit.^[8] However, the repeated use of the auxiliary fuel tank for repositioning helicopters made the special flight permit process unacceptable for operations. In 2003, the auxiliary fuel tank was approved for restricted category^[9] operations. The reason for restricted category was recorded as ‘tank filled from within cabin & no vapour proof barrier around tank.’

In 2009, a job planning approval form was raised by the approval holder for issue 4 of the auxiliary fuel tank engineering order (EO),^[10] which incorporated a 2.9 L expansion space on top of the tank, which cannot be inadvertently filled. This was in accordance with the helicopter certification basis: United States (US) Civil Air Regulations Part 6-Rotorcraft airworthiness: normal category (CAR 6^[11]); CAR 6.423 Fuel tank details – (a) Expansion space:

Fuel tanks shall be provided with an expansion space of not less than 2 percent of the tank capacity. It shall not be possible to fill the fuel tank expansion space inadvertently when the rotorcraft is in the normal ground attitude.

It was determined in the job planning approval form that the change in type design was ‘major’, rather than ‘minor’, which required a request to be submitted to the Civil Aviation Safety Authority (CASA). The reason for the decision was ‘some non-compliances with the installation required restricted category approval.’ The form identified several factors for consideration, which included ‘temporary’, ‘restricted category’ and ‘flammability issues’. It required a design advice submission to CASA with a CAR 6 compliance matrix, and to comply with CASA response’s before proceeding to approval.

In support of the job planning approval process, an email exchange took place between the Design Approver and CASA’s Airworthiness and Engineering Branch to clarify non-compliance issues. This focussed on the need for a tank expansion space (CAR 6.423(a)). The exchange began in September 2009 with the approval holder’s explanation that the tank was only used for repositioning the helicopter and their intent was to approve it in the restricted category. In December 2009, CASA clarified that ‘approval of a non-compliant design simply because the aircraft is to be operated under a restricted [category] is not considered acceptable’. This resulted in a modification to the auxiliary fuel tank to incorporate an expansion space and resubmission of the design advice to CASA.

The latest issue design advice^[12] was submitted to CASA on 12 January 2010 under Australian Civil Aviation Regulation 35 (CAR 35).^[13] In accordance with CAR 35: Approval of design of modification or repair, an application for a modification must satisfy CASA ‘that the design conforms with any relevant design standard in respect of the type of aircraft or aircraft component to which the application relates.’ The design advice informed CASA that the Design Approver intended to approve the modification in the restricted category. The reason given for the auxiliary fuel tank was:

To provide fuel endurance for positioning the helicopter on specific tasks such as powerline patrolling and inspection.

In addition to a CAR 6 compliance matrix, the design advice included the following restrictions, which would apply in the restricted category:

• the fuel tank is to be installed and used only for repositioning the helicopter in connection with the aerial work operations (powerline washing, inspection, repair, etc.)
• the fuel tank must be removed for all other operations (including the aerial work operations conducted)
• essential crew only on board when fuel tank is fitted
• maximum cabin ventilation must be provided when operating with the fuel tank installed
• either doors off or all available vents open
• the helicopter must at all times have sufficient fuel (including required reserves) in the main fuel tank to reach a safe landing site.

Within the compliance matrix there was no reference to CAR 6.604 – Powerplant instruments (a) (1), which required a fuel quantity indicator be installed for each engine or tank. However, there was reference to CAR 6.429 – Fuel quantity indicator. CAR 6.429 provided the following standard:

The fuel quantity indicator shall be installed to indicate clearly to the flight crew the quantity of fuel in each tank while in flight. When two or more tanks are closely interconnected by a gravity feed system and vented, and when it is impossible to feed from each tank separately, only one fuel quantity indicator need be installed.

The compliance matrix provided the following statement for CAR 6.429:

The current indication will alert to remaining fuel. Even if the current valve does fail; the pilot can see the fuel is there and increasing.^[14]

The approval holder reported that the Design Approver likely believed that the auxiliary tank modification met the criteria of CAR 6.429, and therefore CAR 6.604 was deemed not applicable. Based on contemporary practices, in determining the certification basis of a modification to which compliance must be shown, only affected requirements are cited.

CASA reported that their response to the design advice was in the context of allowing for the repositioning of the helicopter (ferry flights) prior to undertaking normal flying activities and was conditional upon the limitations documented. In this circumstance, where a fuel quantity indicator was not to be enforced, CAR 6.429 was considered appropriate. CAR 6.604 was appropriate for a permanently installed auxiliary fuel tank.

Issue 3 of the design advice was accepted by CASA on 18 January 2010 and ‘found to be compliant with the relevant requirements of CAR 6 (including 6.423(a)) as per the compliance matrix as supplied to CASA by email on 12 Jan 2010.’ CASA did not request the associated engineering order (EO) or flight manual supplement (FMS), which were the documents published by the approval holder for the operator. CASA advised the ATSB the decision to review an EO and FMS is dependent upon the experience of the approval holder making the submission. In this case, they were satisfied with the experience of the approval holder and approver.

Engineering order and flight manual supplement

On 9 March 2010, the job planning approval form was updated to include EO issue 5 and FMS issue 3. The reason provided was to clarify the tank capacity on the EO (115 L total and 114 L usable, as measured by the operator) and remove the classification of ‘restricted category’ from the FMS as the tank complied with CAR 6. When EO issue 5 and FMS issue 3 were published on 9 March 2010 and the restricted category was removed, the operator was allowed to install the auxiliary fuel tank in the helicopter as a permanent fit.

The operating restrictions listed in the design advice submitted to CASA were not published in the FMS or EO. However, the approval holder reported that the removal of the restricted category was contingent upon compliance with EO issue 5, which required the expansion tank to be installed. As the expansion tank was not found fitted, the accident helicopter was not entitled to be operated with the auxiliary fuel tank as a permanent fit.

United States Federal Aviation Administration advisory circular

In 1999, the US Federal Aviation Administration (FAA) published advisory circular (AC) 27‑1B on Code of Federal Regulations Part 27 (CFR 27), certification of normal category rotorcraft, the replacement for CAR 6.^[15] AC 27-1B provided an acceptable means, but not the only means, of compliance with CFR 27 and included the following information about the location of fuel tanks:

Separation of fuel tanks and occupiable areas. Fuel tanks should be located as far as practicable from all occupiable areas. This minimizes the potential post-crash fire sources in occupiable areas and the potential for occupant saturation with fuel on impact. The design should be reviewed to minimize these potential hazards.

The following information was provided in reference to preventing occupant injuries:

Elimination of injurious objects within striking distance of the head and other vital parts can be accomplished by removal of objects with sharp edges or rigid surfaces from within striking distance of vital parts of the occupant.

In 2014, the US FAA issued AC 27-1B change 4, which included an explanation for CFR 27.1337 (b) (2),^[16] which was equivalent to CAR 6.429, as follows:

Consistent with the requirements of 27.1337(b)(2), a separate fuel quantity indication is necessary for any interconnected fuel tank that has a flow control device, such as a fuel transfer pump or flapper valve, which could fail and trap fuel. This requirement also applies to auxiliary fuel tanks. A sight quantity indicator that is readable by the flight crew in flight may be acceptable for use with auxiliary fuel tanks.

CASA advised that they consider the solenoid valve fitted to the auxiliary fuel tank plumbing to act as a flow-control device. However, they considered it acceptable for the helicopter not to meet the design standards for the purpose of repositioning flights under a special flight permit or in the restricted category. If the auxiliary fuel tank was to become a permanent fit and used for other modes of operation, then it would be expected that the standards in CAR 6 (6.429 and 6.604) should be met following any modifications.

Neither CASA nor the approval holder provided a record to show CASA was informed of the decision to remove the restricted category.^[17] If it was determined that the design was compliant with CAR 6, as per CASA’s response to the design advice, then the approver could proceed to approval without notifying CASA.

The initial issue of AC 27-1B included the explanation for the purpose of a flight manual with a recommended format, which included the following information:

Section 2 – Normal Procedures:

(a) Pre-flight Checks. This paragraph would include any exterior, interior, and any system checks prior to starting the engine(s).

(c) System Checks. This paragraph would include any system check procedures…which should be accomplished before take-off.

(e) Cruise and/or Level Flight. This paragraph would include any procedures applicable to cruise and/or level flight operation.

The normal procedures in the FMS did not provide any instructions for checking fuel quantity before flight or for checking the operation of the fuel transfer either before flight or in-flight, despite the fact that there was no fuel quantity indicator included in the design. The FMS also did not include a fuel transfer rate, which could be influenced by pressure differences and helicopter attitude changes.

The approval holder advised that the inclusion of the auxiliary fuel tank does not negate the requirement to establish the current fuel state of the helicopter prior to take-off or in-flight. They indicated the auxiliary fuel tank installation included a toggle switch for operation of the fuel-transfer solenoid valve and a ‘fuel transfer’ indicating light on the instrument panel for the verification of fuel transfer inflight (see the instrument lights section in this report).

Fuel policy requirements

Legislation and guidance

As a result of the fuel exhaustion, the ATSB was interested in the legislative requirements which applied to the development of the operator’s fuel policy and procedures. CASA’s Air Operator’s Certificate (AOC) handbook, Volume 2, Flying Operations - Fuel policy and related requirements was referenced to identify and locate relevant legislation and guidance material. The ATSB identified the following two requirements from the AOC handbook as of interest to the investigation:

A method for determining the fuel on board pre-departure, during and after the flight.

A method to cross-check the fuel quantity on board prior to departure.

Regarding a method to crosscheck the fuel quantity on board before departure, the following two legislative references from the AOC handbook were of interest to the investigation:

Civil Aviation Regulation (CAR) 234, Fuel requirements:

(1) The pilot in command [PIC]…must not commence a flight…if he or she has not taken reasonable steps to ensure that the aircraft carries sufficient fuel…to enable the proposed flight to be undertaken in safety.

(2) An operator…must take reasonable steps to ensure that an aircraft does not commence a flight as part of the operator’s operations if the aircraft is not carrying sufficient fuel…to enable the proposed flight to be undertaken in safety.

Civil Aviation Order (CAO) 20.2, Air service operations – safety precautions before flight:

Subsection 6 of CAO 20.2 required the operator to include in their operations manual instructions and procedures for the PIC of an aircraft that has an MTOW [Maximum Take-Off Weight] above 5,700 kilograms to verify the quantity of fuel on board the aircraft before flight.

Regarding a method for determining the fuel on board during flight, the only reference found during the investigation was Civil Aviation Advisory Publication (CAAP) 215-1(2): Guide to the preparation of operations manuals. CAAP 215-1(2) appendix B9: Fuel management, provided the following guidance:

The operator is to develop procedures to ensure that in-flight fuel checks and fuel management are carried out during the flight. Procedures relevant to the operation should include:

Monitoring for fuel leakage.

How fuel checks are carried out and at what regular intervals during the flight.

How the quantity of remaining fuel is compared with actual consumption to ensure the remaining fuel at any time is sufficient to complete the flight.

The operator’s fleet of helicopters were not greater than 5,700 kg MTOW, and in accordance with CAO 20.2, the operator was not required to publish procedures for the verification of fuel on board before flight. CAAP 234-1(1): Guidelines for aircraft fuel requirements, provided guidance on crosschecking fuel quantity before flight and applied to all operators of Australian aircraft, but was written as guidance material, as was CAAP 215-1(2).

CASA reported that, in respect to CAO 20.2, it was determined that there was insufficient grounds to justify the requirement being applied to aircraft with a MTOW less than 5,700 kg. It was assessed as being overly burdensome for many operators within that sector of the industry. Increased requirements are applied as aircraft size or complexity increases.

The CASA AOC handbook on fuel policy listed 14 references from legislation and three from guidance material, in addition to CAAP 215-1(2), which could be applicable to the development of an operator’s fuel policy and procedures. With respect to what constituted a requirement, CASA reported that the AOC handbook has no legislative power and only those requirements that are empowered by legislation are enforceable.

Operations manual

The operator’s operations manual included a fuel policy with flight planning data for each helicopter type in the operator’s fleet. The policy included allowances being made for fuel reserves in flight planning, and a note for McDonnell Douglas 369 pilots to refer to the respective FMS if using the auxiliary fuel tank. The refuelling procedures included instructions for post-refuelling checks, which included the pilot in command’s responsibility to ensure ‘the required amount has been placed aboard the helicopter’. This last statement was in accordance with pilot’s responsibilities under CAR 234.

CAR 215: Operations manual required the operator to provide CASA with a copy of their operations manual and to forward to CASA any amendments to the operations manual. The operator’s fuel policy and fuel procedures were amended in 2015, but at the time of the accident, there were no procedures for determining the fuel on board before or during flight. No evidence was found to indicate that CASA required the operator to publish these procedures. CASA reported that the standard in CAO 20.2 is deliberately less complex for smaller aircraft than for larger aircraft, and in consideration of the protections contained in other regulatory requirements, there was no need to issue a direction under CAR 215 in relation to fuel-system quantity checks.

Civil Aviation Safety Authority surveillance

The last CASA surveillance of the operator prior to the accident flight was dated 19 June 2015. This was a one-day audit with one CASA Flying Operations Inspector (FOI) and was initiated after a lengthy period since the last audit in 2009. The scope of the audit was:

• flight operations – flight system (process in practice)
• operational personnel – crew scheduling (management responsibility) (process in practice).

The CASA surveillance manual indicated that much of the information for auditing the ‘flight system’ was contained in the operations manual. However, the operations manual was not listed as a reference document in the surveillance report. The audit report concluded that the operator’s ‘internal audits, processes in practice, monitoring and improvement with the aid of [safety information system database] are sound.’ No findings were issued.

Cockpit ergonomics

Tablet mount installation

The helicopter was manufactured to be flown by the pilot in command from the left seat instead of the normal right seat helicopter pilot position. The primary flight instruments were located on the left side of the centrally mounted instrument panel and the secondary instruments, including the fuel quantity indicator and low fuel level caution light, on the right side (Figure 3).

Figure 3: VH-PLY instrument panel

The crew member in the rear left seat performed the role of powerline inspector while the crew member in the front right seat performed the role of data recorder. To assist the crew with the powerline inspection the helicopter was modified with three tablet-mounting arms, two arms located between the front seats and one in the rear. The respective flight manual supplement indicated the tablet-mounts must be stowed for take-off and landing. The pilot must also ensure they do not interfere with any existing systems. Paragraph 2.5 of the operating limitations stated the tablet ‘may not be manipulated to a position which obstructs the pilot’s view of the instrument panel.’

The pilot reported he had the tablet-mount extended for use and a moving map displayed with the agreed refuelling location marked, which did not obstruct his view of the fuel quantity indicator. Prior to the accident, the right seat crew member was performing his data recorder duties. Neither the pilot nor the data recorder observed the low fuel level caution light or a low fuel quantity indication prior to the accident.

It was not determined if the front right seat crew member had positioned his tablet-mount in a position which would have obstructed his view of the fuel quantity indicator or low fuel level caution light. At the time of the accident, the right seat crew member was conducting data recorder tasks on his computer with his tablet mount extended. During the investigation, the ATSB adjusted the right seat tablet and found that it could be positioned in a way that would obscure the fuel quantity indicator or low fuel level caution light.

Instrument lights

The master caution panel dimmer system was inspected after the accident and found to be loose and able to be pulled off. The chief engineer reported that when power is turned off, then on, the master caution dimmer is reset to full bright. To dim the master caution panel, the dimmer knob must be pushed in. The pilot reported that during the accident sequence he observed the ‘engine-out’ light illuminate, which was a red warning light on the far left of the caution/warning panel. This indicated the master caution panel was probably not dimmed.

Position of the sun

The operator reported the low fuel level caution light would activate intermittently at about 30 L fuel remaining and remain on constantly at about 25 L fuel remaining; about 15 minutes of flight time. The sun was in the range of the twelve o’clock position at a low angle leading up to the accident.^[18] In this position, the sun would have been in the same general field of view as the instrument panel lights for the pilot in the left seat, who was wearing a helmet with dark visor.

Auxiliary fuel transfer light

The auxiliary fuel tank shutoff solenoid valve had a green indicating light positioned next to the auxiliary fuel transfer switch on the instrument panel. The light was positioned in the circuit between the transfer switch and the solenoid valve and labelled as ‘aux fuel transfer’ on the wiring diagram. The auxiliary fuel transfer switch was also a circuit breaker. When the switch was selected to transfer, the circuit between the helicopter’s electrical power and the solenoid valve closed and the valve powered open. Illumination of the light only indicated that the circuit was closed. It did not indicate the position of the solenoid valve or that fuel was transferring. This was not explained in either the FMS or EO.

Remote warning device

The operator also had an FMS for operating the helicopter with a remote warning device (RWD). According to the FMS, the RWD provided a remote indication of the illumination of any instrument panel caution/warning light within the pilot’s field of view^[19] and minimised the pilot workload during low altitude, high intensity, operations. However, the RWD was not fitted to the helicopter during the accident flight. According to the operator, it was only fitted for specific operations, such as washing powerline insulators.

Fuel quantity indicator

The helicopter’s main fuel tank quantity indicator was a nonlinear indicator, which was more sensitive at lower fuel levels than at higher fuel levels (Figure 4). At the previous routine 100 hourly maintenance inspection, the fuel tank quantity indicator sensor was replaced and a fuel calibration performed. On the fuel quantity indicator, the three hundred pounds’ marker (3) was the equivalent of 162 L and the full marker (F) was 242 L.

The pilot reported he was told the helicopter had been refuelled before flight. He was also observed by the right seat crew member performing his normal pre-start instrument scan and he reported he thought the fuel quantity indicator indicated full. The flight log from the previous day was closed with 170 L of fuel remaining after a 2-hour flight and the pilot transferred the auxiliary fuel tank contents into the main fuel tank during the flight.^[20] In this scenario, the fuel quantity indicator would have indicated close to the red line in Figure 4.

Figure 4: VH-PLY main fuel tank quantity indicator (graduated in pounds x 100)

Previous fuel exhaustion events

A search of the ATSB database for the period from 2003 to 2017 found 76 reports of ‘fuel exhaustion’, which included four accidents with fatalities, three accidents with serious injuries and two accidents with minor injuries, with some accident reports including more than one injury classification. The operations represented in the occurrences included sport aviation, private, aerial work, training, charter and air transport–low capacity. From the 76 occurrences, 26 were for commercial operations, and all reports were for aircraft not greater than 5,700 kg MTOW.

In 2009, the final investigation report into a fuel exhaustion occurrence involving a charter flight in a Cessna 404 in 2007,^[21] the ATSB raised a safety issue against CASA as follows:

Guidance promulgated by the Civil Aviation Safety Authority (CASA) in Civil Aviation Advisory Publication 234-1 regarding aircraft fuel requirements allowed for a fuel quantity cross-check to be conducted after refuelling and without reference to an independent source of onboard fuel quantity information.

At the time, CASA reported they were considering reviewing the information in CAAP 234-1(1) Guidelines for Aircraft Fuel Requirements that refers to fuel quantity crosschecking.

Survivability factors

The ATSB provided the three crew members with the ‘iBrace Survivor Questionnaire’.^[22] The purpose of the questionnaire was to review crash survivability factors. All crew members provided returns, summarised as follows.

The pilot was seated upright in the front left seat with a four-point harness fitted loosely, wearing a helmet. His hands and feet remained on the controls throughout the accident sequence. The impact resulted in a broken back and spinal cord injury. He could not evacuate from the wreckage.

The front right seat crew member was secured firmly in a four-point harness, wearing a helmet. He bent forwards into a brace position during the accident sequence with his feet on the floor. The impact resulted in a broken back, spinal cord injury, and cuts to the hand and temporary loss of consciousness. He was able to evacuate from the wreckage after regaining consciousness.

The rear left seat crew member was wearing helmet and a dispatcher harness with a wander-lead attached to the helicopter. He could not recall what position his body was in during the crash sequence. He was thrown around during the accident sequence and sustained head and spinal injuries, cuts and bruises to the chest and abdomen, and cuts, bruises and fractures of the limbs. He was able to evacuate from the wreckage after regaining consciousness.

__________

1. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
2. A 1,000 L fuel container transported on a trailer.
3. A SARTIME is a time nominated by a pilot to trigger an alert if he or she has not communicated with the person or agency holding the SARTIME by the nominated time.
4. In the hover at 100 ft placed the helicopter in one of the manufacturer’s ‘avoid areas’. The avoid area is a height-velocity combination from which there is insufficient height and/or time to establish autorotation when the engine fails. Operating in this area is a task requirement for powerline inspections.
5. The helicopter was fitted with a ‘Spidertracks’ device, which is a satellite tracking device for aircraft. This enables the aircraft’s position to be monitored from an internet-connected device. It includes an ‘SOS’ button, which can be manually activated by the crew in an emergency.
6. The design organisation had provided 24 different engineering orders to the operator, which were applicable to the operator’s fleet of McDonnell Douglas 369D model helicopters.
7. ‘On the clock’ or ‘by the clock’ means the pilot applied an average rate of fuel consumption to the expected total quantity of fuel on board at the start of the flight to monitor the endurance.
8. A special flight permit may be issued where an aircraft does not meet the applicable airworthiness standards, but is expected to be capable of safe flight for the intended purpose.
9. Restricted category indicated that additional limitations on operations were required because the design did not comply with CAR 6 (normal category).
10. The EO is the technical data which describes the design, shows the design complies with the applicable airworthiness requirements, and provides the production data and instructions for continuing airworthiness.
11. In this report CAR 6 refers to the United States Civil Air Regulations, whereas all other uses of CAR are in reference to the Australian Civil Aviation Regulations.
12. This was the current design advice at the time of the accident.
13. CAR 35 was subsequently replaced with Civil Aviation Safety Regulation 21.M and in February 2015 advisory circular (AC) 21-08 was published on the subject: Approval of modification and repair designs under Subpart 21.M. AC 21-08 incorporates a section on ‘unsafe feature or design characteristic’ which was not required under CAR 35. This is a separate and additional requirement in recognition that an unsafe condition may exist despite design compliance with applicable airworthiness standards.
14. It was unclear what the second sentence meant as the valve could fail open or closed.
15. The Design Approver’s compliance obligation was CAR 6 and the requirements of CFR 27 and AC27-1B were either optional (alternative means of compliance), or not available at the time of decision-making.
16. CFR 27.1337(b) Fuel quantity indicator. Each fuel quantity indicator must be installed to clearly indicate to the flight crew the quantity of fuel in each tank in flight. (2) When two or more tanks are closely interconnected by a gravity feed system and vented, and when it is impossible to feed from each tank separately, at least one fuel quantity indicator must be installed.
17. CASA may have received a copy of the FMS after it was issued to the operator, but this would have been to the CASA team oversighting the operator, rather than the Airworthiness and Engineering Branch.
18. The orientation of the powerline was north-north-east. The approximate elevation of the sun was 34° above the horizon and 22° azimuths east from north on 17 July 2016 at Hawker, South Australia.
19. The FMS did not specify if this was the pilot’s primary field of view, which is 15 ° either side of centreline and 30 ° below horizontal in the normal seating position; or secondary field of view, which extends to 30 ° either side of centreline and from 40 ° above to 45 ° below the horizontal (AC 27-1B).
20. The flight record of 180 L fuel used for a two-hour flight the previous day was less than the fuel flow rates published in the operations manual but consistent with flight log records of fuel consumption between 90 and 100 L/h while the helicopter was deployed on the contract.
21. AO-2007-049: Engine power loss (fuel tank exhaustion) 102 km north Adelaide, SA 18 October 2007, VH-TMP, Cessna Aircraft Company C404.
22. Davies, J. M., Wallace, W.A., Colton, C.L., & Yoo, K.I. (in press). Two aviation accident investigation questionnaires for passenger & crew survival factors & injuries. Aviation Medicine and Human Performance.

Safety analysis

Fuel exhaustion

Prior to departure the pilot requested full fuel for the main and auxiliary fuel tanks from the ground support person. He reported at interview the ground support person replied the helicopter was refuelled the previous day. The only record of a refuel for the previous day occurred between the two flights flown. It is likely that the ground support person confused the sequence of events the day before and believed the helicopter’s tanks were full when reporting this to the pilot.

The pilot reported his omission to visually inspect the contents of the auxiliary fuel tank before departure may have been the result of a distraction during his pre-flight inspection. Being told the helicopter had been refuelled the day before would have also given the pilot the expectation that tanks were full, and may have contributed to missing the fuel check during his pre-flight inspection.

Before starting the engine, the pilot was observed conducting his normal instrument scan; however, the fuel quantity indicator had a nonlinear scale, which indicated close to the full (242 L) level mark at 170 L. The expectation that the tanks were full as indicated by the ground support person meant that when he scanned the flight instruments before flight, he would have been expecting to see a full indication. Combined with the nonlinear scale, this would have made it easy to misperceive the main tank as full. In turn, perceiving the main tank as full would have reinforced his belief that the auxiliary fuel tank (which had no fuel gauge) was also full. The helicopter subsequently departed with about 170 L of fuel on board, but the pilot believed it was carrying about 350 L.

It had become normal practice for the pilot to manage the helicopter’s endurance ‘on-the-clock’. This practice was consistent with the reports from other pilots who had flown with the auxiliary fuel tank fitted. In the absence of a fuel quantity indicator for the auxiliary fuel tank, it was not possible to compute fuel consumption once fuel transfer was started, because the contents remaining in the auxiliary fuel tank became an unknown factor. Hence, there was a need to use a predictive endurance until fuel transfer was completed.

The auxiliary fuel tank transfer light was found serviceable following the accident. Illumination of the transfer light would have provided an immediate response to the pilot when the fuel transfer switch was operated, whereas monitoring the fuel quantity indicator for movement would have provided a delayed response. Therefore, when the pilot selected the fuel transfer in-flight, the auxiliary fuel tank indicator light may have confirmed his expectation that the system was transferring fuel when there was actually no fuel in the auxiliary tank to transfer. The absence of crosschecks between the clock and the fuel quantity indicator resulted in inadequate in-flight fuel monitoring.

The low fuel level caution light was set to illuminate with about 15 minutes of fuel remaining and found to be serviceable following the accident. However, it was possible the position and luminance of the sun reduced the pilot’s visual sensitivity to the low fuel level caution light. The operator’s remote warning device, used to alert the pilot to the activation of a caution or warning light on the master caution/warning panel, was not fitted. Leading up to the accident sequence, the pilot’s hover reference was the powerline on the left side of the helicopter and the front right seat crew member was performing his data recorder duties. Therefore, it was likely that the low fuel level caution light was not detected because neither of the front seat crew members were scanning the instrument panel leading up to the accident.

The power loss occurred at about 1 hour and 50 minutes after departure. The pilot reported that, while in the hover at about 100 ft, the engine went quiet and the ‘engine-out’ warning light was flashing. Following the accident both helicopter fuel tanks were found empty, which was consistent with a fuel load on departure of about 170 L. No damage was found to the fuel tanks, which would have resulted in an in-flight fuel leak, therefore it was concluded the power loss and collision with terrain was the result of fuel exhaustion.

Design approval of the auxiliary fuel tank

The helicopter’s fuel system was modified with an auxiliary fuel tank fitted in the rear right side of the cabin, in an occupiable area, and without any device for fuel quantity indication. The Design Approver’s 2010 design advice submission to the Civil Aviation Safety Authority (CASA) included a compliance matrix for the fuel tank against what they identified as the relevant airworthiness standards. In his email communication and design advice submission, the Design Approver indicated his intent to approve the fuel tank in the restricted category and that it was to be used only for repositioning flights. CASA’s Airworthiness and Engineering Branch reviewed the design advice within this context, but responded that the restricted category was not justification for non-compliance with airworthiness criteria, with specific reference to the requirement for a tank expansion space.

In consideration of CASA’s position, the Design Approver elected to address the identified non-compliance issue (tank expansion space). The subsequent modification of the fuel tank with an expansion space resulted in a response from CASA that the design complied with the relevant requirements of CAR 6 and the Design Approver may approve the modification. CASA did not enforce the fuel quantity indicator criteria with the understanding that the fuel tank was only to be used for ferry flights, and removed for aerial work operations. However, it was likely that the Design Approver interpreted CASA’s response to the effect that there were no CAR 6 non-compliances and therefore the restricted category was unnecessary. An approval in the normal category allowed the fuel tank to become a permanent fit and avoided the additional maintenance burden of removing the auxiliary fuel tank between repositioning flights and the start of aerial work operations.

In 1999, US Federal Aviation Administration advisory circular (AC) 27-1B was published, which provided an explanation and means of compliance for the US Code of Federal Regulations Part 27. Since Part 27 replaced CAR 6, many of the CAR 6 requirements were replicated in Part 27. AC 27-1B indicated that there were risks associated with locating a fuel tank in an occupiable area of the helicopter, which it was desirable to avoid. They included the risks of flailing injuries to occupants and saturation with fuel in the event of an accident. Although not required, a review of AC 27-1B in addition to CAR 6 may have led to the conclusion that the restricted category was more appropriate than the normal category for the accident helicopter with the modified fuel system. Particularly in consideration of the nature of the powerline inspection operation, which involved the helicopter operating for extensive periods in the height/velocity avoid area.

In 2014, AC 27-1B provided an explanation for the equivalent Part 27 standard to CAR 6.429, which indicated that separate fuel quantity indicators were required if there was a flow control device installed between fuel tanks. A single fuel quantity indicator would be unsuitable for the accident helicopter’s modified fuel system, because a failure of the solenoid valve in the closed position prior to completion of transfer would result in the fuel quantity indicator over-reading the fuel available for the engine.

On review of AC 27-1B during the investigation, CASA considered the solenoid valve to be a flow control device, but accepted the configuration for operations under a special flight permit or in the restricted category. Since the design advice submission process did not include a copy of the flight manual supplement, CASA’s Airworthiness and Engineering Branch did not have visibility of the removal of the restricted category.

Development of fuel policy

The operator had a fuel policy and procedures published in their operations manual at the time of the accident. Their fuel policy and procedures were updated to revision 1 status the year prior to the accident. This would have provided CASA with visibility as it is a Civil Aviation Regulation (CAR) 215 requirement for the operator to provide them with a copy of the operations manual and forward them any amendments.

CAR 234 (2) indicated the operator had a responsibility to ensure there was sufficient fuel on board before flight. The CASA Air Operator’s Certificate handbook indicated that the operator’s responsibility is demonstrated by publishing procedures and providing training in accordance with those procedures. However, Civil Aviation Order (CAO) 20.2 did not require commercial operators of aircraft not greater than 5,700 kg maximum take-off weight (MTOW) to have published procedures for the verification of fuel on board before flight. Therefore, CAO 20.2 was not consistent with CAR 234 (2) for those operators.

CASA reported that the apparent non-alignment of CAO 20.2 with CAR 234 (2) was based on an assessment that the CAO 20.2 requirements would be overly burdensome for operators of less complex aircraft. In addition, the material published in Civil Aviation Advisory Publication 215 and 234 was provided as guidance material. Hence, no direction was issued to the operator by CASA to direct a change to their operations manual.

An ATSB aviation occurrence database search for fuel exhaustion events, from 2003 to 2017, found commercial operators represented about one-third of all reports (26 reports from a total of 76), which were all for aircraft not greater than 5,700 kg MTOW. The presence of commercial operators indicated that the applicable fuel regulations may be less than adequate, and shows that commercial operators may not implement effective fuel policies and training to prevent fuel exhaustion events.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Civil Aviation Safety Authority
• Design Organisation
• Line-worker (data recorder)
• Line-worker (inspector)
• Pilot
• Operator
• South Australian Police.

References

Advisory circular 21.1(1), Aircraft airworthiness certification categories and designations explained, Civil Aviation Safety Authority, 2000

Advisory circular 21-08, Approval of modification and repair designs under Subpart 21.M, Civil Aviation Safety Authority, 2015

Advisory circular 27-1B, Certification of normal category rotorcraft, incorporating change 1-7, US, Federal Aviation Administration, 2016

Air Operator’s Certificate handbook volume 2 – Flying operations, Civil Aviation Safety Authority, 2016

AV-9986.001-01, Auxiliary fuel tank shut-off valve wiring, [Design organisation], 2003

Civil Air Regulations Part 6–Rotorcraft airworthiness: normal category, Civil Aeronautics Board, US, Washington D.C. 1957

Civil Aviation Advisory Publication 215-1(2), Guide to the preparation of operations manuals – Annex B - Aircraft operations, Civil Aviation Safety Authority, 2014

Civil Aviation Advisory Publication 234-1(1), Guidelines for aircraft fuel requirements, Civil Aviation Safety Authority, 2006

Civil Aviation Order 20.2, Air service operations – safety precautions before flight, Civil Aviation Safety Authority, 2006

Civil Aviation Regulations 1988

Design advice DA-9986.001-01, Transfer tank installed – an auxiliary fuel tank which tops up the main tank, [Design organisation], (submitted 2010)

Design advice response DA-9986.001-01, Issue 3, Installation of auxiliary fuel tank, Civil Aviation Safety Authority, 2010

Engineering order EO16660.001/1, Issue 1, iPad and windows tablet installation, [Design organisation], 2011

Engineering order EO9986.001/1, Issue 6, Auxiliary fuel tank, [Design organisation], 2010

Flight manual supplement FMS16660.001-01, iPads and windows tablet installation, [Design organisation], 2012

Flight manual supplement FMS9986-001/1, auxiliary fuel tank installation, [Design organisation], 2010

Flight manual supplement for operations with the remote warning device fitted, Issue 2, [Design organisation], 1999

Job planning approval form, Job No.: AV9986.001, [Design organisation], 2009

Operations manual, Fuel policy, [operator], 2015

Surveillance manual, Civil Aviation Safety Authority, 2015

Surveillance report, [operator], Civil Aviation Safety Authority, 2015

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, the design organisation, the helicopter operator, Line-worker (data recorder), Line-worker (inspector) and the pilot in command of the accident flight.

The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Findings

From the evidence available, the following findings are made with respect to the fuel exhaustion and collision with terrain involving a McDonnell Douglas Corporation 369D, registered VH-PLY, 36 km north-west of Hawker, South Australia, on 17 July 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The Civil Aviation Safety Authority (CASA) accepted that the design advice for the auxiliary fuel tank complied with the relevant requirements of the United States Civil Air Regulation 6. This was within the context of a proposed restricted category approval to permit repositioning flights. However, the response from CASA was likely interpreted by the Design Approver to permit approval in the normal category, which resulted in the auxiliary fuel tank becoming a permanent fit without a fuel quantity indicator.
• The pilot omitted to conduct a visual check of the auxiliary fuel tank contents before departure, which resulted in the helicopter departing with insufficient fuel for the planned flight.
• During the flight, the pilot managed the helicopter endurance ‘by the clock’, which resulted in him not detecting a low fuel level.
• While conducting powerline inspections the helicopter's fuel supply was exhausted, which resulted in a forced landing.

Other factors that increased risk

• The current legislation does not require commercial operators of aircraft not greater than 5,700 kg maximum take-off weight to provide instructions and procedures for crosschecking the quantity of fuel on board before and/or during flight. This increases the risk that operators in this category will not implement effective fuel policies and training to prevent fuel exhaustion events.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Air Operator Certificate holder fuel policy requirements

Safety issue number: AO-2016-078-SI-01

The current legislation does not require commercial operators of aircraft not greater than 5,700 kg maximum take-off weight to provide instructions and procedures for crosschecking the quantity of fuel on board before and/or during flight. This increases the risk that operators in this category will not implement effective fuel policies and training to prevent fuel exhaustion events.

Fuel policy requirements: Air Operator Certificate holders operating aircraft not greater than 5,700 kg

Safety Advisory Notice: AO-2016-078-SAN-009

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

The helicopter operator has advised the ATSB that they have taken the following safety action:

Corrective actions plan

The operator completed an investigation, implemented interim safety controls and developed a corrective actions plan. Their plan included:

• modifications to the auxiliary fuel tank system
• permanent installation of the remote warning device
• amendment to their operations manual to include prescriptive fuel check instructions.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 2 October 2015, the pilot of a Cessna 182 aircraft, registered VH-DNZ (DNZ), was tasked to conduct parachute operations. The pilots of two aircraft, the Cessna 182 along with a Cessna 206 (C206), planned to depart from Parafield Airport, and drop parachutists to land at Victoria Park, Adelaide, before returning to land at Parafield, South Australia. A total of four similar ‘sorties’ were planned for the day.

The target landing zone for the parachutists was Victoria Park, which would require the pilots to obtain a clearance from Adelaide air traffic control (ATC) to enter Adelaide control zone. Parachute operations normally included a drop area of a 1 NM radius around the target landing zone. However, the north-western corner of that 1 NM radius circle from Victoria Park infringed on the separation required for aircraft arriving and departing on runway 05/23 at Adelaide Airport. Therefore, the drop area agreed between Airservices Australia and the Australian Parachute Federation (APF) for the operation was as depicted by the red zone in Figure 1.

Figure 1: Drop area agreed between Australian Parachute Federation and Airservices Australia

Source: Australian Parachute Federation – annotated by ATSB

On the day, the wind was from the northwest, which required the parachute aircraft to run in to the northwest, in order to drop the parachutists upwind of the target zone. Operating to the northwest of the agreed red zone, and thus outside the previously agreed parameters of the red zone, would place the parachute aircraft in the main runway separation zone at Adelaide, with the possibility of associated delays in ATC providing a clearance.

The pilots of the two aircraft arrived at Parafield at about 0930 Central Daylight-saving Time (CDT) and discussed the details for the day’s operations. These details included the direction of the jump run, ATC clearances, two ‘staging areas’ – one north and one south of the drop zone at Victoria Park, where the aircraft could hold if required, and different inbound and outbound flightpaths to assist in ensuring separation between the two aircraft.

At about 1030, the pilot of DNZ conducted a daily inspection of the aircraft, and did not find any defects. The pilot added fuel to bring the total to 110 L of fuel on board the aircraft. The pilot assessed that was more than adequate for the proposed 28-minute sortie (see Fuel calculations for further information).

After preparing the aircraft, the two pilots spoke to the nominated contact person from Adelaide ATC and the APF ground personnel at Victoria Park to coordinate the day’s plans.

At about 1220, the parachutists arrived at Parafield Airport. After the parachutists boarded the aircraft, the C206 was to depart first, followed about 10 minutes later by DNZ. The pilot of DNZ observed the C206 engine start, and then shut down again almost immediately. The reason for the engine shut down was that ATC had advised the C206 pilot that, due to aircraft arriving at Adelaide, if they departed now, there would be a 20-minute delay. ATC also advised that if the aircraft took off at 1320, they would not have to wait. The C206 subsequently departed at about 1320.

At about 1327, the pilot of DNZ started the aircraft’s engine, and DNZ departed from Parafield at 1331, with the pilot and four parachutists on board. The aircraft tracked outside controlled airspace, overhead Substation, then towards Woodside (Figure 2). At about 1337, when about 2 NM north of Woodside, at 2,500 ft, the pilot of DNZ contacted Adelaide Approach air traffic control, and requested an airways clearance to enter controlled airspace to complete the parachute drop. The approach controller advised the pilot of DNZ to remain outside Class C airspace.

At about 1340, the approach controller cleared the pilot of DNZ to track from their current position to Woodside then to Staging Area South and climb to 3,500 ft. The Staging Area South was overhead Mt Lofty. The C206 was already holding in Staging Area South at 4,500 ft. The pilot of DNZ communicated with the C206 pilot on the company radio frequency, sighted that aircraft, and maintained visual contact with it.

At about 1355, the approach controller cleared the pilot of the C206 to track for the drop point and, about 2 minutes later, cleared the pilot to conduct the drop. After completing the drop, the C206 was cleared to the northern staging area, then to return to Parafield.

The pilot of DNZ continued to hold at Mt Lofty, at 3,500 ft, conducting orbits of 3-4 minutes duration each.

Figure 2: Adelaide visual terminal chart with relevant locations

Source: Airservices Australia annotated by the ATSB

At about 1406, after completing seven orbits, the pilot of DNZ was advised to expect about a 30-minute delay, with a drop time of 1445. The pilot calculated the approximate fuel remaining, and assessed that they would be approaching the minimum fuel required to return safely to Parafield. The pilot contacted the APF ground personnel at Victoria Park to advise them of the requirement for further holding. They responded that they would phone the ATC representative and then let the pilot know what they would like them to do.

About 2 minutes later, the approach controller revised the estimated drop time to 1433. At about 1411, the pilot of DNZ asked the approach controller whether an earlier clearance would be available if they amended the run into the original red zone (Figure 1). Remaining within the red zone would increase the distance of DNZ from aircraft on final approach to runway 23 at Adelaide, and potentially expedite a clearance. The controller replied that if they could remain in the original area, they could expect a drop time of 1426. The controller confirmed again at 1417 that they had reports the wind was suitable (to operate within the red zone), so the pilot of DNZ could expect a clearance only into the original red zone.

At about 1420, the approach controller asked the pilot of DNZ to confirm they were maintaining 3,500 ft. At that time, the engine ran roughly, and the aircraft momentarily descended. The pilot conducted emergency checks; changing the selected fuel tank from right to both and then left, assessing the full range of throttle and rpm, and switching between the magnetos, but the engine continued to run roughly. The engine temperature and pressure gauges were indicating in the normal range. The pilot decided to abandon the parachute drop and requested a clearance to track directly from their current position to Parafield, due to fuel. About 1 minute later, the approach controller asked the pilot of DNZ whether they could accept a clearance to track to Port Adelaide, over other traffic that was on final approach to runway 23 at Adelaide, and the pilot replied ‘affirm’. At about 1422, the controller cleared the pilot of DNZ to track to Port Adelaide at 3,500 ft.

The rough running then got worse, so at about 1424, the pilot requested a landing at Adelaide Airport although did not, at that stage, declare an emergency. The approach controller advised the pilot to expect a clearance to land at Adelaide, and advised that traffic was a Conquest at 5 miles, landing on runway 23, and to report sighting that aircraft. The pilot replied ‘not sighted, where again sorry?’ and the approach controller replied ‘your 12 o’clock^[1], 4 miles on final for runway 23’.

The pilot continued to attempt to resolve the engine issues, and communicated with the ground personnel to advise of the situation. The pilot reported also looking for a suitable landing site in case the engine stopped completely and a forced landing was required. At about 1425, the approach controller cleared the pilot of DNZ to descend to 2,000 ft. Twenty-six seconds later, the approach controller cleared the pilot of DNZ for a visual approach to left base for runway 23.

Just then, the engine stopped completely. The pilot had sighted Victoria Park racecourse out to the right side of the aircraft, so turned immediately towards it. At about 1426, the pilot made a MAYDAY^[2] call to Adelaide Approach, advising that they were conducting a forced landing at Victoria Park. The pilot secured the aircraft engine, and told the parachutists to bring their weight forwards and to brace for impact.

The pilot aimed to land the aircraft in ‘pit straight’ on the racecourse, which was directly into the north-westerly wind, but as the aircraft lined up with the straight, the pilot saw a car on the bitumen. The pilot conducted a turn to the right then to the left and landed the aircraft on grass. The pilot reported that it was a very heavy landing, and that the aircraft landed either flat or nose wheel first. The nose wheel broke off, the propeller struck the ground, and the aircraft slewed to the left. Two of the parachutists were ejected from the aircraft during the impact. Two of the parachutists sustained serious injuries, and two were uninjured. The pilot sustained minor injuries and the aircraft was substantially damaged (Figure 3).

Figure 3: Accident site showing damage to VH-DNZ

Source: South Australia Police

Fuel calculations

During the pre-flight inspection, the pilot dipped the fuel tanks to determine the amount of fuel in the tanks. The dipstick indicated that about 80 L of fuel remained in the aircraft’s right fuel tank and zero in the left fuel tank. The pilot reported that this correlated with the fuel log from the previous day’s flight along with the aircraft being parked on a slope leaning slightly to the right. The pilot added 30 L of fuel to the left tank, so there was a total of 110 L of fuel on board the aircraft. Based on a planned fuel consumption rate of 65 L/hr for parachute operations, the pilot calculated that there was sufficient fuel for 1.7 hours of flight. The pilot assessed that was more than adequate for the planned 28-minute sortie.

The engine started surging about 50 minutes after the aircraft departed from Parafield, and stopped completely about 5 minutes later.

The planned fuel consumption rate of 65 L/hr was used for parachute operations. The actual fuel consumption recorded for the aircraft in cruise flight was less, due to operating at a reduced power setting and a leaner fuel/air mixture. The aircraft handbook stated the cruise performance with the mixture leaned at 5,000 ft above mean sea level (AMSL) and 2,000 rpm and 20 inches manifold pressure, was about 32 L/hr. The pilot reported that about 10-11 L of fuel in each tank was unusable.

Phone communications between APF and ATC

At about 1100, the ground representative from the APF rang the nominee from ATC, and advised that due to wind of 25 kt from 310°, they would need to extend the boundaries from the original ‘red zone’, to about 1 NM north-west of the target landing site. The APF representative also stated that they were aware that the extended area would incur delays due to jet aircraft operating into Adelaide Airport.

The APF representative advised ATC that the pilots had fuelled up so they could hold.

When the pilot of DNZ was advised of a 30-minute hold, the ground representative from the APF rang ATC, and asked whether they could operate in accordance with the red zone (rather than the extended zone), as the wind was not as strong as forecast. The ATC nominee advised that they would be able to get a clearance for that in about 15 minutes and the APF representative advised that the pilot would have sufficient fuel for that.

Pilot comments

The pilot of DNZ provided the following comments:

• The pilot reported that after start-up, the fuel gauge indications corresponded with having 80 L and 30 L of fuel in the tanks. The pilot did not look at the fuel gauges again at any stage of the flight, or include the fuel gauges in the instrument scan while performing emergency checks.
• During the emergency procedures, changing the fuel tank selector from Right to Both and to Left did not make the rough running of the engine any better or worse.
• The pilot did not apply carburettor heat at any time.^[3]
• The pilot requested a clearance to track direct to Parafield rather than tracking outside controlled airspace to the east, because there were no suitable places to conduct a forced landing due to steep, hilly terrain.
• During the flight, the pilot had kept a mental fuel log based on time in the air and estimated fuel remaining, but not a written log.
• While holding over Mt Lofty, the pilot had the engine set at about 20 inches manifold pressure and 2,100-2,200 rpm, and estimated holding for about 40-45 minutes at that power setting. The pilot had leaned the fuel mixture to slightly rich of peak exhaust gas temperature.
• The planned duration of the sortie, from Parafield to drop the parachutists and return, was 28 minutes, so the pilot expected that with holding that might increase to about 45 minutes.
• The pilot was not aware that the APF ground personnel advised ATC that the pilots were able to accept significant delays.
• The pilot heard a commotion with the parachutists in the back, and after the incident, realised that the parachutists had been asking to exit the aircraft.

Parachutist comments

One of the parachutists, who was also a licenced pilot and owner of Cessna 182 aircraft, provided the following comments:

• The communications prior to commencing the flight were poor. The parachutists were advised they would be dropped from 6,000 ft, which was not their preferred height for the operation.
• There was little to no communication with the pilot prior to departure, including no safety briefing to the parachutists. A safety briefing card or placard in the aircraft, detailing emergency procedures, may assist in an emergency.
• As the aircraft became airborne, the parachutist, who had been struggling to fasten the single point harness, realised that it was unserviceable. This resulted in parachutists being ejected from the aircraft during the collision.
• When holding around Mt Lofty, the parachutist was concerned that the pilot had an unusually high power setting for holding. That may have significantly increased the fuel consumption. The sound of the high power setting did not change until the engine coughed and spluttered a few minutes before it stopped.
• As soon as they heard the engine issues, the parachutists asked the pilot if they could jump, as they had sighted suitable safe landing areas below. The pilot reportedly rejected their request. They made a further request to jump when approaching 1,500 ft above ground level, as their lowest safe exit height, but again the pilot refused the request.
• The pilot extended flap and then retracted it late in the approach, which resulted in a very high rate of descent. The aircraft’s left wingtip came into very close proximity with a building at that time.

Australian Parachute Federation report

A representative of the Australian Parachute Federation aircraft committee inspected the aircraft following the accident. The representative found that the aircraft impacted the ground very heavily in a nose-down attitude. About half a litre of fuel was drained from the system after the aircraft was removed from the site.

The report stated that the aircraft should still have had fuel on board, based on taking off with 110 L on board, and at the maximum consumption rate. However, while holding and conducting continuous right orbs, fuel may have been lost from the tanks due to venting from the fuel valve.

Video footage

The ATSB obtained video footage of the incident taken from inside the aircraft. During the approach, the aircraft banked steeply to the right towards a built-up area, then to the left towards the landing site. As the aircraft wings levelled, the nose pitched up and the left wing appeared to come into close proximity with a building. At that time, the pilot retracted the flaps. The aircraft then descended rapidly and collided with the ground in a nose-down attitude.

CASA investigation

The Civil Aviation Safety Authority (CASA) also conducted an investigation into the incident. At the time of publication of the ATSB report, CASA had not finalised its investigation. CASA advised the ATSB that two fuel dipsticks appear to have been in use by the aircraft operator. One dipstick had fuel quantity depicted in 10 L increments, the other in 20 L increments. If the pilot had calculated the fuel on board based on 20 L increments, but used a dipstick with 10 L increments, rather than having 110 L of fuel on board at start-up, there would have been 55 L. That fuel quantity correlated with the length of time the engine ran before fuel exhaustion occurred. Additionally, the same aircraft had been involved in a similar fuel starvation incident in 2011, where the CASA investigation found that there was probably more than one dipstick in use at the time.

CASA subsequently provided the ATSB with its final investigation report into the accident. CASA’s investigation did not locate any dipstick for the aircraft and concluded that the engine failure was most likely due to ‘fuel exhaustion as a result of the incorrect calculation of the available fuel in DNZ’s tanks prior to the accident flight.’

Safety message

Pilots are reminded of the importance of careful attention to aircraft fuel state. ATSB Research report AR-2011-112 Avoidable accidents No. 5 Starved and exhausted: Fuel management aviation accidents, discusses issues surrounding fuel management and provides some insight into fuel related aviation accidents. The report includes the following comment:

Accurate fuel management also relies on a method of knowing how much fuel is being consumed. Many variables can influence the fuel flow, such as changed power settings, the use of non-standard fuel leaning techniques, or flying at different cruise levels to those planned. If they are not considered and appropriately managed then the pilot’s awareness of the remaining usable fuel may be diminished.

This incident also highlights that a timely decision to conduct a precautionary landing may be better than having no choice but to conduct a forced landing.

Aviation Short Investigations Bulletin - Issue 48

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The clock code is used to denote the direction of an aircraft or surface feature relative to the current heading of the observer’s aircraft, expressed in terms of position on an analogue clock face. Twelve o’clock is ahead while an aircraft observed abeam to the left would be said to be at 9 o’clock.
2. Mayday is an internationally recognised radio call for urgent assistance.
3. The Bureau of Meteorology provided the ATSB with a report of the weather conditions at the time of the incident, including temperature, dew point and relative humidity. There was no risk of carburettor icing.