Landing gear/indication

Investigation summary

What happened

On 14 February 2025, an instructor and student pilot were conducting a training flight using a Sling Aircraft Sling LSA, registered VH‑PPY, operating from Moorabbin Airport in Victoria. After landing and as the aircraft was vacating the runway, there was a jolt and an unusual sound from the right side of the aircraft. After the instructor taxied the aircraft to the operator’s parking area and disembarked, the right main landing gear brake disc was found to have fractured through its entire circumference.

What the ATSB found

The ATSB found that the aircraft brake disc fractured during normal operation due to severe corrosion that compromised its structural integrity. This corrosion was not identified by those maintaining and operating the aircraft as having progressed to a point where failure of the brake disc was possible. 

The fractured brake disc fitted to the aircraft was an aftermarket part. Manufacture of the brake disc was consistent with the manufacturer’s specifications, however it had not been approved for fitment to the Sling LSA and therefore assurance that it was a suitable replacement had not been established.

What has been done as a result

The operator replaced all corroded brake discs fitted to its Sling LSA fleet with the correct Matco parts, and the aircraft are now moved onto the apron prior to boarding allowing easier access to inspect the landing gear. Additionally, the operator discussed the occurrence in a safety presentation to instructor pilots which included a description of the event, photos of the corroded brake, possible reasons for the corrosion, and a direction to ensure inspection of the brakes is carried out prior to flight.

Safety message

There are multiple opportunities for those operating aircraft to identify defects such as corrosion, and those maintaining the aircraft should take timely action to prevent its progression or replace that part before the serviceability of the aircraft is affected. Additionally, consideration should be given to the operating environment of the aircraft and whether additional maintenance activities could be employed to limit corrosion development. 

The investigation

The occurrence

On 14 February 2025, an instructor and student pilot were conducting a training flight from Moorabbin Airport, Victoria, using a Sling LSA, manufactured by Sling Aircraft[1] and registered VH‑PPY. 

At about midday, the instructor landed the aircraft on runway 17R.[2] As the aircraft was vacating the runway onto taxiway A4, there was a jolt and an unusual sound from the right side of the aircraft. The instructor continued to taxi, and after noticing that the aircraft’s wheel brakes were less effective, brought the aircraft to a stop and conducted after-landing checks without noting anything significant.

The instructor re-commenced taxiing to the operator’s parking area, and after disembarkation saw that the right main landing gear brake disc had failed (Figure 1). The instructor noted the brake failure on the aircraft’s maintenance release, grounding the aircraft.

Figure 1: VH-PPY right brake disc post-flight

Source: Learn to Fly Australia and Sling Aircraft, annotated by the ATSB

Context

Aircraft information

General information

The Sling LSA is a low-wing, 2-seat aircraft, designed and manufactured in South Africa for private flying and flying training. The aircraft is constructed predominantly from aluminium alloy, has a fixed, tricycle landing gear and is powered by a Rotax 912 ULS2‑01 engine. 

VH‑PPY was manufactured in 2018 and was first registered in Australia in March 2019. The aircraft had been first registered by the current operator, Learn to Fly Australia, in October 2020. At the time of the occurrence, the aircraft had accumulated 2,951.2 hours total time in service.[3]

The nose and both main wheels were originally fitted with aerodynamic fairings, however the aircraft’s main wheel fairings were removed[4] from VH‑PPY when the aircraft entered service, for ongoing ease of inspection and tyre changes.

Main landing gear brakes

General information

The Sling LSA main landing gear wheels are fitted with disc brakes (Figure 2). Braking action is achieved by the pilot’s feet acting on the aircraft’s rudder pedals, directing hydraulic fluid to the brake caliper piston to move the lining (pad), which in turn acts on the friction area of the brake disc. 

Figure 2: Sling LSA main landing gear and Matco wheel brake assembly

Source: Sling Aircraft, annotated by the ATSB

Aircraft manufacturers prescribe specific approved parts for use on their aircraft. Parts that are not approved by the manufacturer are ineligible for fitment. The brake assemblies approved for fitment to the Sling LSA are manufactured by Matco Aircraft Landing Systems (Matco). They consist of a wheel rim, a brake disc, and a brake caliper assembly. Matco used zinc as the standard corrosion protection coating on the brake disc, however electroless nickel plating[5] is offered as an option. Matco indicated that the nickel plating offers better protection, longevity and high temperature tolerance. The aircraft manufacturer did not specify the type of coating on the Matco brakes fitted to the Sling LSA.

The brake disc fitted to VH‑PPY at the time of the occurrence was manufactured by Rapco (Figure 3). Rapco brake discs are manufactured from forged carbon steel and electroless nickel plated for corrosion prevention. Rapco brake discs are identified with a laser-etched part number and have 2 areas where the section thickness has been reduced, which is not a feature of the approved Matco part.

Figure 3: Brake disc as received at the ATSB’s technical facility

Source: ATSB

The aircraft manufacturer advised that there were no approved alternates to the Matco brake discs for fitment to the Sling LSA. The maintenance organisation reported that they were not aware that the disc fitted to VH‑PPY was an unapproved part and there was no record in the aircraft logbooks of fitment of the Rapco brake disc.

Inspection and maintenance 

The aircraft’s pilot operating handbook contained instructions for a pre-flight check to be carried out prior to the first flight of the day and after any maintenance activity. This check included an inspection of the right and left main wheels and brakes for fluid leaks, security, general condition, tyre condition, inflation and wear. The preamble for the pre‑flight check noted that:

The word “condition” in the instructions means a visual inspection of surface for damage deformations, scratching, chafing, corrosion or other damages, which may lead to flight safety degradation.

The operator of VH-PPY required its instructor pilots to carry out a daily inspection prior to the first flight of the day, which encompassed the pre-flight requirements and other inspections such as checking the engine oil level and checking onboard fuel for the presence of water. Instructor pilots then carried out pre-flight inspections prior to every flight and supervised students in carrying out daily inspections prior to every flight they conduct.

VH‑PPY was being used for flying training and in the 2.5 months prior to the occurrence had flown about 140 flights. Periodic inspections and servicing were being carried out on VH-PPY every 100 flying hours, which would typically be accrued in about 2 months. The inspections were carried out in accordance with the Sling 2 and Sling LSA maintenance manual. This included an inspection of all components of the main landing gears for ‘poor condition’. The maintenance organisation, which had been carrying out periodic and other maintenance on the operator’s Sling LSA since 2023, was monitoring the condition of the brakes while it was sourcing replacement parts. It reported that while it was aware of the increasing corrosion on the brake disc, it had not reached a point where it considered it to be critical.

A section of the maintenance manual provided guidelines for corrosion prevention and noted that:

The information supplied here is as a general guideline only, and is by no means intended to be exhaustive, complete or authoritative. For more in depth information refer to an applicable and authoritative publication, such as the [Federal Aviation Administration] FAA Advisory Circular AC 43.13-1B: Acceptable Methods, Techniques and Practices - Aircraft Inspection and Repair.

…

It is highly advisable that expert advice be sought with regard to corrosion related issues. 

Included in the general guidance was that:

… If any trace of corrosion is detected it should be removed as soon as possible and the applicable part should be treated immediately to prevent further corrosion.

Treatment consists of mechanically removing as much as possible of any corrosion by-products, applying corrosion inhibitor and replacing any original finish.

Matco published inspection requirements for the approved brake assembly in a technical service bulletin. This document provided methods to remove corrosion from the area where the brake lining contacts the disc and prohibited removal of the plating from other areas of the brake disc. The minimum thickness[6] of the friction area was specified as 0.130 inches (3.303 mm).

Rapco, the manufacturer of the brake disc fitted to VH‑PPY, specified the minimum thickness of the friction area as 0.167 inches (4.242 mm).

Generic inspection and maintenance guidelines

The United States Federal Aviation Administration (FAA) advisory circular AC 43.13‑1B – Acceptable Methods, Techniques and Practices - Aircraft Inspection and Repair[7] provided guidelines for corrosion preventative maintenance, an inspection guide, and procedures for corrosion removal for specific material types such as ferrous alloys. The Civil Aviation Safety Authority (CASA) airworthiness bulletin AWB 02-045 permitted AC 43.13-1B to be used as approved maintenance data for minor repairs of aircraft that meet the eligibility requirements.

The FAA advisory circular AC 43.4B – Corrosion Control for Aircraft[8] also provided guidelines for the identification of corrosion on ferrous metals, information on how it propagates, guidelines for its removal and for the subsequent treatment of those areas. The advisory circular includes instructions for a corrosion prevention plan based on the location of the aircraft. As the Australian coastline is considered a ‘severe’ zone, cleaning, inspection, lubrication, and preservation was suggested to be carried out every 15 calendar days.

Examination of failed brake disc

The brake disc was examined at the ATSB’s technical facility in Canberra. 

The brake disc exhibited uniform corrosion[9] with associated material loss and thinning of the base metal. The disc was most severely corroded around the region of failure, which was adjacent to the friction (braking) area and associated with a reduction in part thickness. The measured maximum thickness of the brake disc friction area was 3.63 mm (0.143 inches), making it about 0.612 mm (0.024 inches) less than the minimum thickness specified by Rapco.

Elemental analysis of the disc materials was conducted using energy dispersive spectroscopy (EDS). The materials were consistent with a plain carbon steel base layer and electroless nickel surface coating. 

Electroless nickel plating is a barrier coating, meaning that it protects the substrate (in this case the brake disc) by sealing it off from the environment. This can be contrasted with zinc plating where zinc acts as a sacrificial material that corrodes in preference to the substrate, thereby protecting it.

To examine the remaining plating for continuity, a section was taken through the brake disc. The plating was measured to be about 10 µm (0.01 mm) thick and was broadly continuous around the hub but degraded closer to the region of failure. There were examples where cracking in the plating corresponded to sub-plating corrosion of the disc (Figure 4).

Figure 4: Sectioned view of damaged plating

Source: ATSB

Other aircraft

After the occurrence, the operator checked the brake discs fitted to the remaining 6 Sling LSA in its fleet. Those aircraft were first registered in Australia between 2017 and 2021. The disc part numbers were not confirmed, however images showed that most had the same changes in section thickness as the subject Rapco disc. All of the discs were observed to have advanced corrosion with resulting material loss. Additionally, a radial crack was found on the brake discs of 2 aircraft in the friction area. These brake discs were replaced immediately with the correct Matco parts and the remainder during scheduled maintenance.

Matco reported that it had seen corrosion on brake discs in service when there has been a loss of plating, but not to the extent seen on the brake disc from VH‑PPY. The aircraft manufacturer also was not aware of instances of corrosion to this extent.

Aircraft operating environment

The operator conducted flying training from its facility at Moorabbin Airport, which is situated about 3 km from Port Phillip Bay (a large saltwater bay) at its closest point.

The operator’s aircraft were parked outside on concrete pads, surrounded by gravel and grass (Figure 5). Rain reportedly pools on and around these pads.

Figure 5: Parking area for the operator’s aircraft

Source: Learn to Fly Australia, annotated by the ATSB

Safety analysis

The right brake disc of VH‑PPY was severely corroded and its structural integrity had been compromised to the point where it failed during normal aircraft braking after landing. While there were no injuries or further aircraft damage from this occurrence, failure of the aircraft’s braking system could result in a more serious outcome such as a runway excursion or surface movement collision.

The Rapco brake disc fitted to VH-PPY was not approved by the aircraft manufacturer for fitment to the Sling LSA, so assurance that it was a suitable replacement had not been established. However, the materials used in the construction were similar to those offered by the original equipment manufacturer (Matco) and found to be consistent with Rapco specifications. 

Rapco employed an electroless nickel barrier coating to prevent corrosion. This meant that corrosion can initiate at any point the plating becomes discontinuous, which was the most likely initiator for the corrosion in this case. 

It was not determined when the brake disc had been replaced and, therefore, the time taken for the corrosion to develop was not established. However, VH‑PPY was being parked outside and operated in the vicinity of a saltwater environment, which would have contributed to the corrosion development. The effect of the environment was also demonstrated by the extent of corrosion observed on the brake disc assemblies of the other 6 aircraft in the operator's fleet. 

There were multiple opportunities to intervene ahead of the failure, given that the aircraft was being inspected daily by pilots, and typically every 2 months by a maintenance organisation. Importantly, the maintenance organisation was aware of the corrosion, but had not identified that it had progressed to a point where the structural integrity of the brake disc had been compromised, or taken any maintenance actions to limit its progression. There are authoritative publications that provide information for the prevention and maintenance of corrosion and, if needed, guidance can be sought from the aircraft or brake manufacturers. 

Findings

From the evidence available, the following findings are made with respect to the wheel brake failure involving Sling Aircraft Sling LSA, VH-PPY, at Moorabbin Airport, Victoria, on 14 February 2025. 

Contributing factors

• The corrosion on the brake disc assembly of VH-PPY was not identified by those maintaining and operating the aircraft as having progressed to the point where the brake's structural integrity had been compromised. 

Other findings

• The brake disc fitted to the aircraft was not approved for fitment to the Sling LSA and therefore assurance that it was a suitable replacement had not been established.

Safety actions

Safety action

The operator replaced all corroded brake discs fitted to its Sling LSA fleet with the correct Matco parts, and the aircraft are now moved onto the apron prior to boarding, allowing easier access to inspect the landing gear. Additionally, the operator discussed the occurrence in a safety presentation to instructor pilots which included a description of the event, photos of the corroded brake, possible reasons for the corrosion, and a direction to ensure inspection of the brakes is carried out prior to flight.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the instructor pilot
• the aircraft manufacturer
• the brake disc manufacturer
• Civil Aviation Safety Authority
• Learn to Fly Australia
• Westernport Aviation Services. 

References

ASM International Handbook Committee. (1982). ASM Handbook Volume 5 Surface Cleaning, Finishing, and Coating. Metals Handbook Ninth Edition.

ASM International Handbook Committee. (1987). ASM Handbook Volume 13 Corrosion.

The Airplane Factory, Sling 2 Pilot Operating Handbook, 10 June 2019.

The Airplane Factory, Sling 2 and Sling LSA Maintenance Manual, 26 November 2021.

U.S. Department of Transportation Federal Aviation Administration. (2018). AC 43.4B Corrosion Control for Aircraft. Washington DC: U.S. Department of Transportation Federal Aviation Administration.

U.S. Department of Transportation Federal Aviation Administration. (1998). AC 43.13-1B Acceptable Methods, Techniques and Practices - Aircraft Inspection and Repair. Washington DC: U.S. Department of Transportation Federal Aviation Administration.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• aircraft manufacturer
• brake disc manufacturers
• instructor pilot
• Learn to Fly Australia
• maintenance organisation
• Civil Aviation Safety Authority
• National Transportation Safety Board (United States)
• South African Civil Aviation Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

On the morning of 26 October 2024, the pilot of a De Havilland Aircraft of Canada DHC‑2 Beaver aircraft, registered VH‑OHU, departed Hamilton Island aerodrome, Queensland, with 4 passengers on board, for a 10-minute scenic flight to Whitehaven Beach, Whitsunday Island. The aircraft touched down on the water with the right main gear not retracted into the float. As a result, the aircraft rapidly yawed to the right, nosed over and became submerged inverted. The pilot self-evacuated and then, when they found no one else on the water surface, promptly returned to help the passengers egress. The pilot and 4 passengers sustained minor injuries, and the aircraft was substantially damaged.

What the ATSB found

The ATSB found that, after departing Hamilton Island, the right main landing gear did not retract and had seized in the extended position, likely due to corrosion. For undetermined reasons, the pilot did not identify that the right main gear had remained extended during their pre-landing checks, either via the landing gear position indication panel, the amphibian gear advisory system (AGAS) annunciation or the wing-mounted mirror. 

In addition, the ATSB noted that the AGAS annunciation alert for an asymmetric configuration, which required immediate pilot action, was similar to a normal gear position advisory. This increased the risk that a pilot would not recognise that the gear was in an unsafe condition for a water landing.

Following the collision with water, and with the aircraft submerged and inverted, the left rear cabin door could not be opened by the pilot or passengers, which delayed their egress. However, the pilot opened the right main door and assisted all passengers to evacuate.

As required by the operator, the pilot had completed helicopter underwater escape training about one month prior to the accident and credited this as a life-saving course.  

Following several floatplane accidents in Canada, the Transportation Safety Board of Canada recommended the fitment of regular and emergency exits that allowed rapid occupant egress following a survivable collision with the water. Viking Air Limited subsequently developed push-out windows and revised more intuitive automotive-style door latches for the rear cabin door on the DHC‑2 aircraft. These modifications were not fitted to VH-OHU nor were they required by regulations. 

What has been done as a result

In response to the accident, Hamilton Island Air advised it has implemented formal initial and refresher training for pilot maintenance tasks, as well as installation of a second mirror on the right wing of its current DHC‑2 aircraft. It has developed a sign-off form to document the daily washdown and preventative maintenance procedures. In addition, it incorporated a minimum weekly systems check flight, including landing gear cycle, where the aircraft had not been recently operated. Further, it introduced annual theory training and 180-day proficiency flight checks, conducted by authorised flight training organisations.

The Civil Aviation Safety Authority has developed airworthiness bulletin AWB 32-029 Issue 1 Supplementary Type Certificated Amphibian Float Main Gear Slide Wear in Marine Environments. The bulletin recommended enhanced vigilance and maintenance actions on the landing gear components to ensure reliability of the landing gear and the actuating system.

Safety message

As shown in this accident, inadvertent water landings in amphibian aircraft with one or more gear extended can rapidly result in the aircraft becoming submerged and inverted. This investigation reinforces the effectiveness of helicopter underwater escape training, not exclusively for helicopter pilots but also for pilots who operate any type of aircraft over water such as floatplanes.

Further, this accident highlights the value of having alternate means of exiting an aircraft post-accident. This is particularly important if the pilot is unable to assist and/or the fuselage is distorted, to increase the occupants’ chance of survival in the event of an impact with water.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns is reducing the severity of injuries in accidents involving small aircraft.

The investigation

The occurrence

On the morning of 26 October 2024, a De Havilland Aircraft of Canada DHC‑2 Beaver amphibian floatplane, registered VH‑OHU and operated by Whitsunday Air Services (trading as Hamilton Island Air), was being prepared for a scenic flight from Hamilton Island to Whitehaven Beach (Whitehaven), Whitsunday Island, Queensland. The flight would typically be about 10–15 minutes, with about 75 minutes at Whitehaven, before returning to Hamilton Island.

Prior to boarding the aircraft, the 4 passengers viewed a pre-flight safety briefing video and were fitted with a pouch‑style constant wear lifejacket.[1] The pilot then conducted an additional briefing at the rear left cabin door of the aircraft. The passengers recalled this included being demonstrated how to use their seatbelts, don the lifejackets and operate the rear door handle, among other things. The passengers were seated, in pairs, in the middle and rear seat rows, with the seat to the right of the pilot not utilised.

The aircraft departed to the south-east and made a left turn to track toward Chance Bay, Whitsunday Island (Figure 1). The pilot reported that, during initial climb, they set climb power and selected the landing gear to retract (see Landing gear actuation system). The pilot noted the gear was cycling, as evidenced by the illuminated red ‘hydraulic pump’ lamps.  

At about Chance Bay, the pilot spoke with the pilot of a company helicopter that was following, via very high frequency radio transmission, to coordinate with them as they were both heading toward Tongue Point. From this location, the pilot observed the water conditions and location of boats moored along Whitehaven. They described their observation as 7 kt, from the south-east and about 3 or 4 vessels on the water at Whitehaven. They then reported observing 4 blue ‘gear up’ lights on the landing gear panel and they did not see any of the main wheels extended in the mirror mounted on the left wing (see Mirror). The pilot then conducted an orbit over Tongue Point and Hill Inlet, before making a turn and doing a second pass so all passengers could view the beaches and inlets below.

After advising the passengers they would shortly be landing, the pilot commenced the pre-landing cockpit flow checks, including isolating the passengers from the aircraft audio system. The pilot advised they confirmed 4 blue lights, ‘saw no gear visible out the left window’, completed their flow checks and commenced the descent for landing. The pilot broadcast their intent to land at the south end of Whitehaven. They then completed the ‘finals checks’ from memory, which included checking the landing gear position again, before focusing on the landing.

Figure 1: Whitehaven Beach with reference to Hamilton Island, with approximate flight path depicted in yellow

Note: Approximate flight path derived from limited passenger images and video footage. Source: Google Earth, annotated by the ATSB

Upon touching down on the water, the aircraft bounced, then yawed sharply to the right, before nosing over and becoming submerged inverted. With the aircraft quickly filling with water, the pilot released their seatbelt and went to open their door, which they reported required some force. On exiting the aircraft, their leg was caught in the seatbelt, however, they were able to free themselves and swam to the surface. At the same time, 2 of the passengers had released their seatbelts and were both trying to open the left rear cabin door, which was adjacent to where they had both been sitting. They turned the door handle one way, and tried the other way, but could not open the door.

When the pilot did not see any of the passengers on the water surface, they returned to the aircraft to help them. They swam down and attempted to open the rear left door. Despite considerable effort, with their feet positioned on the airframe either side of the door, the door would not open, so they swam over to the right rear cabin door. The right door was able to be opened, again with a degree of force required, and the pilot pulled the nearest person out and took them to the surface. After taking a breath, the pilot returned and retrieved a second person, before assisting the remaining passengers.

One of the passengers, when they realised they could not open the left rear door, and with the cabin now almost completely filled with water, swam to the right side of the aircraft. They saw their partner was still in their seatbelt, so released it and continued to search for the door handle. They then felt their partner being pulled from them and out of the aircraft. They do not recall how they exited the aircraft but found themselves on the surface. The other passenger who was initially attempting to open the left rear door reported observing their partner, but it was very difficult to see. They then recalled being pulled from the aircraft, however, their partner could not remember how they exited the aircraft.

A nearby vessel rendered assistance to the pilot and passengers and transported them to Hamilton Island for medical attention. Once aboard the vessel, the pilot looked at the aircraft and observed the right main gear wheels had not retracted into the float (Figure 2).

Figure 2: VH-OHU underside of floats, showing right main wheels not retracted

Source: Used with permission, annotated by the ATSB

The pilot and passengers sustained minor injuries, and the aircraft was substantially damaged. It was reported that the aircraft sustained further damage during the retrieval from the water, before being transported to Mackay Airport, for storage.

Context

Pilot information

The pilot held a Commercial Pilot Licence (Aeroplane), with single and multi-engine class ratings and design feature endorsements including retractable undercarriage and floatplane. The pilot also held a current class 1 medical certificate with nil restrictions.

Prior to commencement with Whitsunday Air Services (trading as Hamilton Island Air), the pilot had accrued 563 hours total aeronautical experience, with 696 water landings, in a Cessna 182 aircraft on fixed floats. On 3 September 2024, the pilot underwent a familiarisation/transition flight in a fixed float DHC‑2 aircraft with an approved flight training organisation. The pilot was then employed with Hamilton Island Air. On 10 September 2024, the pilot commenced line training through the operator’s in‑command-under-supervision (ICUS) program, operating the DHC‑2 and the GippsAero GA8 Airvan^[2] aircraft under the supervision of the operator’s ‘fixed wing specialist’ training pilot (see Operational information).

The pilot completed ICUS training with a line check on 8 October 2024. The training pilot set a 20 kt wind limitation for operations at Whitehaven for the next 25 flight hours, for the pilot to fine‑tune their skills ‘in the air and on the water’. The aircraft daily flight records indicated the pilot conducted solo flights on 15 and 25 October, consisting of circuit training at Hamilton Island. In addition, on 18 October they conducted a flight to Whitehaven, with 5 Hamilton Island Air staff as passengers, similar to the tour that was the accident flight. The accident flight was the pilot’s first flight with fare-paying passengers. 

As of the morning of 26 October, the pilot had accrued 28 hours and 84 water landings in VH‑OHU. While the pilot had accrued 84 water landings in an amphibian aircraft, typically, the landing gear was not required to be extended and then retracted during training that consisted of multiple water landings in one session. As such, their gear actuation cycle experience was likely lower.

Helicopter underwater escape training (see Helicopter underwater escape training) was a Hamilton Island Air requirement, for all its helicopter and fixed-wing flight crew, to be completed during their induction and followed by recurrent training every 2–3 years. The pilot completed their initial underwater escape training on 24 September 2024.

The pilot self-reported to being well rested and feeling ‘fully alert’ on the morning of 26 October 2024. In addition, they advised they ‘felt comfortable with the aircraft’ and they had no distractions during the preparations for landing at Whitehaven.

Aircraft information

General

VH‑OHU was an amphibian De Havilland of Canada DHC‑2 Beaver, serial number 826, a predominantly all metal high-wing aircraft manufactured in 1956 and first registered in Australia in 2015.

The DHC‑2 was originally designed and manufactured by De Havilland Aircraft of Canada, Limited. Viking Air Limited was the type certificate holder from 2006 until 2024. In August 2024, Viking Air Limited amalgamated with De Havilland Aircraft of Canada Limited, and De Havilland Aircraft of Canada Limited became the type certificate holder.

The aircraft was powered by a Pratt & Whitney ‘Wasp Junior’ R-985 9-cylinder, single row, air‑cooled radial engine, which drove a Hartzell HC B3R30-4B 3‑blade propeller. The aircraft was fitted with Wipline 6100 series amphibious floats, manufactured by Wipaire.

Cockpit and cabin configuration

There were 2 forward cockpit doors and 2 rear cabin doors. The cabin door handle was located along the aft edge of the door and required the row 1 passenger to reach behind the seat to open the door (Figure 3). The front seats were equipped with 3-point lap-sash style restraints and the 3-person cabin bench seats were equipped with 2-point lap-belt restraints.

Figure 3: Seat and door locations

Source: Pilot’s operating handbook, annotated by the ATSB

Maintenance history

The aircraft logbook statement showed the airframe, electrical, engine, instruments and radio were to be maintained in accordance with the Civil Aviation Safety Authority (CASA) Schedule 5.[3] The float system was to be maintained in accordance with Wipaire instructions for continued airworthiness.

On 6 December 2022, VH‑OHU was subject to a forced landing just after take-off from Hamilton Island. The aircraft was subsequently removed from service. The aircraft was partly disassembled and transferred to Mackay in July 2023. Between January and September 2024, the aircraft underwent scheduled maintenance conducted by a CASA‑authorised maintenance organisation. Additional maintenance included treatment of corrosion and replacement of corroded hardware and components. This included inspection of the landing gear carriage assemblies and replacement of both slide tubes and all proximity sensor switches (see Landing gear actuation system). A landing gear system retraction test was also performed at this time.

The current maintenance release was issued on 3 September 2024 and there were no recorded defects at the time of the accident. The aircraft had accrued about 18 hours on the maintenance release, with a total time of 18,342 hours. Landings were recorded on the maintenance release, however, there was no distinction between water or land, nor if the gear had been retracted during water landing training or circuits from Hamilton Island.

Landing gear system

General

The landing gear incorporated within the amphibious floats is a retractable, quadricycle type with 2 free castoring nose (or bow) wheels and 4 (2 sets of dual) main wheels (Figure 4). Steering on the water is accomplished by a water rudder located at the rear of each float, which is cabled into the existing aircraft rudder system. Steering on land is accomplished by differential braking on the main landing gear wheels.

Figure 4: VH-OHU showing the amphibious float components

Source: Maintainer, annotated by the ATSB

Landing gear actuation system

Landing gear operation is initiated by movement of the landing gear handle, with the extension and retraction accomplished by 2 electrically‑driven hydraulic pumps. When the pilot selects the gear handle to UP or DOWN, hydraulic pressure in the system will drop and pressure switches will automatically turn on the hydraulic pump motors to maintain operating pressure in the system. When the gear cycle is completed, pressure in the system will increase to the limit where the pressure switches automatically shut off the pumps. If the pressure in the system drops to a preset value, the pressure switches turn the pump motors back on and build up the pressure to the limit again. Only the main gear system operation will be detailed in this report. 

The main gear is mechanically locked in both up and down positions. When the gear is selected to UP, the main gear down hook unlatches from the rear locking pin. Hydraulic pressure exerted on the actuator piston drives the carriage assembly to move forward along the slide tube, with the wheels moving aft, until the gear up hook latches on the forward locking pin (Figure 5). With no further movement once all 4 gear are retracted into the float, hydraulic pressure will increase until the pumps automatically switch off. 

Figure 5: Main gear assembly diagrams, including VH‑OHU forward locking pin (inset)

Source: Wipaire and the maintainer (inset), annotated by the ATSB

The landing gear indication panel, to the right of the pilot’s seat (at the base of the control column), contained 10 lamps. Four blue to indicate the 2 nose and 2 main gear were up, 2 red to show hydraulic pump operation and 4 amber to indicate the gear was down. In addition to the standard equipment, VH‑OHU was also fitted with a hydraulic pressure gauge for pilot reference (Figure 6). 

Each gear actuation operates independently (no set sequence) and therefore, the main gear UP and DOWN lamps are progressively activated by proximity switches, when the respective latch hook nests over the locking pin. The red hydraulic pump lights should extinguish shortly after all 4 UP or DOWN lamps are illuminated.

The airplane flight manual supplement for the amphibian floats described ‘bulb replacement during flight’. Where a lamp is not illuminated as expected, the pilot can readily remove the lamp and a known functioning lamp can be inserted into that location. This allows the pilot to determine if the non-illumination is a defective bulb, or other system issue. 

Figure 6: Typical landing gear panel

Source: Used with permission, annotated by the ATSB

The airplane flight manual supplement for the amphibian floats included the following:

The supplement further included that, where cycling of the gear does not rectify an asymmetric condition, rather than landing on water, the preferred option is to conduct the landing on a hard surface or grass:

Landings of this sort produce little tendency to nose over when checklist procedures are used, even when conducted on hard surface runways, and will result in little or no damage to the floats.

Mirror

In addition to the landing panel gear position indication, the aircraft was also fitted with an optional mirror, installed on the left wing (Figure 7). Wipaire advised the mirror was not part of its float modification, however, it was aware it was a common addition to float planes. 

This mirror allowed the pilot in the left seat to view the position of all 4 gear. This was particularly effective to confirm if the right main gear was retracted or extended from the underside of the right float, which was not possible without the mirror. The company pilots the ATSB spoke with reported varying opinions on the effectiveness for observing the right main gear via the mirror (see Operational information). However, all reported the mirror on the aircraft was correctly aligned following the recent maintenance and was effective in determining gear position.

Figure 7: Left wing mirror location, with representation of extended gear visible view

Source: Used with permission, annotated by the ATSB

Amphibian gear advisory system

The aircraft was also fitted with a Wipaire-authorised amphibian gear advisory system (AGAS), which provided the pilot with supplementary gear position information. Following departure, once the aircraft increased through a threshold airspeed, the system was armed. Upon slowing down through the threshold airspeed, in preparation for landing, the AGAS ‘Gear Advisory’ amber lamp (Figure 8), positioned on the instrument panel in front of the pilot, would illuminate. In addition, an audio annunciation, heard through the front seat headset/s, would commence. Where all 4 gear were retracted, the annunciation would consist of ‘gear up for water landing’ (female voice). Conversely, where all 4 gear were extended, the annunciation would be ‘gear down for runway landing’ (male voice). The audio annunciation would repeat every few seconds, until silenced by the pilot pressing the gear advisory lamp. The annunciation was a prompt for the pilot to check their gear configuration was correct for the intended landing surface.

Figure 8: Example of location of gear advisory lamp in DHC‑2 instrument panel

Note: the insert is taken from the AGAS airplane flight manual supplement. Source: Used with permission, annotated by the ATSB

The AGAS also had a ‘check gear’ advisory. In this case, when the aircraft slowed through the threshold airspeed, the gear advisory amber lamp would illuminate and the annunciation of ‘check gear’ would be heard in the same female voice and similar tone as that for the ‘gear up for water landing’ advisory. There were no additional tones associated with this alert. Check gear indicated an asymmetric condition in the landing gear, where one or more proximity switches had not closed. This was designed to prompt the pilot to abort the landing and troubleshoot the discrepancy. The airplane flight manual supplement for the AGAS included the warning:

In addition, to ensure the system was functioning prior to flight, the ‘operational checklists’ detailed the ‘before take-off’ checks as:

• annunciator switch – PRESS and HOLD for 2-3 seconds
• test audio – VERIFY message is audible
• annunciator switch – VERIFY annunciator light flashes.

Wipaire advised that the ‘test’ audio check contained the gear up and gear down messages only. That is, the check gear annunciation was not included in the system test audio.

Wipaire maintenance documentation

The Wipaire instructions for continued airworthiness (ICA) described the general servicing of the floats and landing gear. The manual also included the following warnings to ensure corrosion from saltwater operations was kept to a minimum:

…

The ICA 25-hour maintenance requirements for the landing gear included washing the aircraft and floats with fresh water and inspecting surfaces and hardware for signs of corrosion, especially with saltwater use. In addition to specific nose gear maintenance actions, the main wheel bearings and main gear carriages were to be greased. This maintenance on VH‑OHU was typically conducted by the maintainer. The maintenance documentation recorded that a 25-hour float inspection was conducted by the maintainer on 5 October 2024, about 15 hours since the issue of the maintenance release.

The ICA inspection time limits and checklist section did not include a specific check for corrosion on the slide tube. Wipaire advised it was covered in the servicing section for ‘movable parts’, which detailed the inspection:

For lubrication, servicing, security of attachment, binding, excessive wear, safe-tying, proper operation, proper adjustment, correct travel, cracked fittings, security of hinges, defective bearings, cleanliness, corrosion, deformation, sealing and tension.

The 25-hour inspection was conducted with the aircraft on extended landing gear. In this configuration, the forward end of the slide tube could be inspected. However, the carriage assembly was positioned at the aft end of the slide tube, preventing inspection at this location. A gear retraction test, to check for correct operation of the gear up and down lock hooks, was to be conducted at 200-hour intervals. With the gear retracted, this then provided the opportunity to inspect the aft end of the slide tube.

Wipaire published service letter #80 AT-802 Fire Boss Slide Tube Corrosion in 2006. It described reports from operators of ‘sticking main gear actuators due to corrosion on the slide tube’. It noted that the corrosion was partially caused by gravel or debris from the main landing gear tyres eroding through the hard anodised surface of the slide tube, exposing the underlying aluminium, which was more susceptible to corrosion. Part of compliance included inspecting the slide tube for erosion and/or nicks and wiping the slide tube down with a clean rag soaked in lubricant. Wipaire advised there was no specific service letter to address corrosion for the 6000/6100 series floats.

Pilot maintenance

Due to the salt laden environment and exposure to seawater, the operator reported washing the aircraft with fresh water at the end of each operating day. In addition, greasing of the nose and main gear components, and other aircraft care activities, were periodically carried out. These additional tasks were to be carried out by an appropriately trained pilot, however, it was not recorded on the maintenance release or other formal record. It was also noted that there was no practice of washing the aircraft if it had not been operated for several days. 

The maintainer conducted the pilot maintenance training, demonstrating the additional maintenance tasks. The pilot of VH‑OHU had not yet received the formal training prior to the accident but advised that they had been shown these tasks by their training pilots.

Meteorological information

The meteorological conditions reported by the pilot at the time of accident were consistent with the Bureau of Meteorology forecast, with east-south-east winds of about 7–8 kt and good visibility. In addition, the pilot’s report and passenger footage showed the water conditions were ideal for float plane operations and sun glare was not angled into the cockpit and across the instrument panel.

Wreckage information and component examination

The ATSB did not attend the accident site or wreckage examination in Mackay, instead the ATSB liaised with the maintainer and the maintenance organisation that conducted the post-accident examination of the landing gear. The ATSB also reviewed images and video footage taken during these examinations.

Initial examination

The maintainer examined the aircraft, in the presence of the insurance representative, after it was retrieved from the ocean and provided the following observations regarding the landing gear system:

• the aircraft was significantly disrupted during the retrieval from the water, including damage to the landing gear panel, which prevented the landing gear selector position to be definitively established
• the landing gear appeared undamaged
• hydraulic fluid was drained and appeared to be of expected quantity, with no water contamination
• the 4 blue lamps were removed for testing, however, their location prior to removal was not recorded
• one of the blue lamps failed testing, however, it could not be determined if this was from seawater immersion or a pre-existing fault.

The wreckage was then transferred to Mackay for storage and further examination.

About 2 weeks after the accident, the landing gear was examined by the maintainer and an engineer from another CASA-authorised maintenance facility. They provided a report to the ATSB, with following general observations:

• hydraulic pump 1 and 2, AGAS and gear lamps circuit breakers were engaged, indicating the system was operating as expected
• it was not possible to carry out a continuity and functional check of the gear panel indication system due to corrosion and moisture from saltwater ingress
• fuses for pumps 1 and 2 ‘ON’ lamps tested serviceable
• both nose gear assemblies and the left main gear were observed to be up and locked, indicating a complete retraction
• the right main gear was extended
• some corrosion was noted on the forward face of both the left and right carriage assembly to slide tube interface.

The maintainer advised the ATSB that, when they tried to move the left main gear carriage, it initially did not move. However, ‘a small knock with a hammer freed the carriage’, which then moved freely. The carriage was likely held up by the observed minor corrosion at the slide tube interface. Further, there was ‘little to no damage’ on the slide tube, compared to the same location on the right slide tube.

Right main gear examination

Detailed examination and testing of the right main gear assembly was then conducted. The report included the following observations: 

• the down hook was found to be free of the locking pin (unlocked)
• the right main gear was approximately 1.5–2 mm from fully down
• gear position light proximity switches tested for resistance to ground with no issues
• continuity testing of the proximity sensor switches showed UP and DOWN ‘open’, which was correct for the current configuration (gear mid travel).

Hydraulic pressure was then applied to the right main gear using a hand pump and calibrated pressure gauge. With 870 psi applied in the retraction direction, the carriage did not move along the slide tube. This was despite progressively adding oil to the slide tube/carriage interface, supplying grease to the carriage, disconnecting the shock strut and applying mechanical assistance via a pry bar.

The hydraulic pressure supply was then transferred to the extend direction. The carriage and slide tube moved together and closed the 1.5–2 mm gap. With this actuation, the actuator piston moved relative to the carriage assembly and the DOWN lock engaged as per design specifications. Testing of the proximity switch showed it to be closed, correct for the configuration. The direction of hydraulic pressure was reversed to retract and the DOWN lock was observed to disengage freely, with the proximity switch again testing correctly.

The report noted that at no time did the carriage move relative to the slide tube during the testing, establishing that the carriage assembly was seized on the slide tube. When the slide tube was removed from the float, a slide hammer and block of wood was successful in separating the carriage assembly from the slide tube. A significant amount of corrosion was then noted on the slide tube.

The ATSB then requested the left and right slide tubes and carriage assemblies be provided for further examination.

Component examination

The ATSB and Wipaire conducted testing and analysis to try to determine the circumstances that allowed the corrosion to develop. Examination of the left and right slide tubes and carriage assemblies was conducted at the ATSB’s technical facilities in Canberra, Australian Capital Territory.

The right slide tube had 2 bands of corrosion that corresponded with the bushing locations in the carriage, at about the fully extended location (Figure 9). The left slide tube showed no similar damage. Both carriage assemblies exhibited grease around the UP and DOWN hooks and internally. The components were not serialised, so the history of the carriages prior to the aircraft entering Australia could not be determined.[4] 

Figure 9: Comparison of slide tubes, showing corrosion bands on the right slide tube (on the right) and location of bushings examined by the ATSB

Source: ATSB and used with permission, annotated by the ATSB

Detailed examination of the components was then conducted, with reference to the Wipaire-supplied specifications.

The slide tubes were manufactured from aluminium with an anodised coating. The slide tube dimensions were measured to be within specifications and the anodised layer was the correct thickness. The slide tube surface was non-conductive, as expected for an anodised layer.

The bushings were a tri-layer construction, with a base layer of steel, with sintered (porous) bronze and then coated in a PTFE[5] ‘sliding layer’. The bushing could be replaced and therefore, the carriage time in service did not necessarily correspond to the bushing time in service. The bushings of both carriages were examined, with observations including the internal diameters of all bushings were within drawing tolerances and the right bushings were more worn than the left (Figure 10).

Figure 10: Difference in bushing wear with the left (left) showing largely intact PTFE layer (grey) and right (right) showing significant exposure of the sintered bronze layer

Source: ATSB

The right carriage bushing located near the grease nipple was sectioned. Examination identified areas where the PTFE layer was not present, exposing the bronze layer and showing some evidence of scoring (Figure 11). The PTFE layer was non-conductive in contrast to the bronze.

Figure 11: Right carriage bushing surface showing Teflon/lead layer (grey), exposed bronze layer (copper) and some evidence of scoring (bright lines)

Source: ATSB

The slide tube corrosion patterns were consistent with galvanic corrosion between the exposed bushing bronze layer and the aluminium slide tube base metal, in the presence of salt from coastal operations. The difference in wear between the left and right carriage bushings likely influenced the degree of corrosion on the respective slide tubes. The bushings with a higher amount of retained, non-conductive PTFE layer showed significantly less corrosion on the corresponding slide tube.

The ATSB determined that there were no material or manufacturing issues identified with the slide tubes, and therefore the thin, hard anodised coating was likely damaged or worn through in this area, to allow for the dissimilar metal contact. This type of damage was also observed in discrete locations in deeper score marks on the slide tube, away from the main areas of corrosion. 

Damage to the anodise was unlikely to have been directly from the worn bushings, since the bronze is softer than the hard anodise layer, but it was possible for dirt, sand or other abrasive debris to have become entrapped between the bushings and slide tube. While there was no significant entrapped material identified during the ATSB examination, the mechanism was shown to exist, as described in Wipaire service letter #80. 

Operational information

Operator overview

Whitsunday Air Services, trading as Hamilton Island Air, conducted tourist charter flights to various locations in the Whitsundays, Great Barrier Reef and Hamilton Island areas, using a variety of fixed-wing and helicopter types. At the time of the accident, it operated a fleet of 17 helicopters and 3 fixed-wing aircraft: VH‑OHU, a GA8 Airvan and a Cessna 208.

Training pilot observations

The operator had an appointed fixed-wing specialist, who oversighted the fixed-wing operations and pilot training. The fixed-wing specialist (training pilot 1 – TP1) had advised the operator their intention to depart the organisation in September 2024. In August, they commenced correspondence with the accident pilot, in preparation for their employment and training. 

TP1 collected VH‑OHU from the maintenance organisation in Mackay. Due to the aircraft coming out of extended maintenance, and TP1 having not operated it for a period of time, TP1 reported conducting a series of test flights, including water landings near Mackay and then en route to Hamilton Island. TP1 reported that the landing gear and AGAS were operating as expected. In addition, TP1 advised the mirror was correctly oriented to view all 4 gear. TP1 then commenced training the accident pilot on VH‑OHU, between 10 and 20 September 2024, before leaving the organisation. 

Training was then conducted by the current fixed-wing specialist (training pilot 2 – TP2), from 5 October 2024. The training again included land and water landings, with TP2 advising the landing gear and AGAS systems were functioning correctly. TP2 advised the left mirror was correctly oriented, however, the right main gear could sometimes be difficult to distinguish from the background contrast (such as terrain, sky, water). TP2 reported their preference for having an additional right-side mirror, and they were in the process of procuring a second mirror at the time of the accident.

Pilot recollections

Accident day

With regard to the day of the accident, the pilot reported:

• they did not feel any operational or time pressure
• they were comfortable with operating the aircraft solo, and with passengers
• the landing area only contained a few vessels, therefore, workload was not increased
• there were no distractions from the passengers during the approach to land and landing
• while there was a checklist available, the pre-landing checks were completed from memory, which was permitted by the operator’s procedures
• they observed 4 blue lights indicating the gear was up for a water landing
• they checked the mirror
• they did not recall hearing the AGAS annunciator just prior to landing
• during the accident sequence the aircraft flipped ‘within a second and I was underwater, upside down, almost instantly submerged, no air at all’.

Following the aircraft becoming submerged inverted, the pilot advised that, due to their recent helicopter underwater escape training, they ‘came right into action’ and ‘wasted no time’. The pilot advised that they would recommend the training to pilots operating sea planes or ‘any planes over water’.

Further, the pilot reported that, had they observed the extended right wheel, they would not have conducted the water landing, and would have returned the aircraft to Hamilton Island for a runway landing.

Training and aircraft systems

The pilot reported that they were happy with their training from both training pilots. In addition, they did not perceive any difficulties with training on the DHC‑2 and GA8 Airvan concurrently. 

When discussing the mirror, the pilot described its importance in determining gear position. However, they also reported that there might be a blind spot that means the right main gear may be difficult to see.

When asked by the ATSB if the AGAS self-test was successful prior to the accident flight, the pilot reported to not being aware of this procedure. The pilot also reported to not have heard the AGAS ‘check gear’ annunciation during their training.

Seaplane operations guidance

The Seaplane Pilots Association published guidance on amphibious gear management best practices, to ‘enhance safe operations within the seaplane community’.[6] The guidance advocated the use of checklists and described triggers or cues, with each phase of flight, ‘to deter landing with the gear in the wrong position’. The ‘on water-based landing’ section included, in part:

• several gear-position validation checks, during initial flyover, pre-landing operations (1st power reduction, setting flaps et cetera) and establishing on final approach to land
• verbalise each gear position validation while visually confirming
• pay attention to the gear advisory system, if installed.

In addition, the guidance stated, ‘it is very important to crosscheck the surface intended for landing with the gear position selected and where the gear actually is positioned’ and included:

As general guidance, an amphibious aircraft should be considered more vulnerable to a catastrophic accident, which may include serious injury and death, with the gear down. While all efforts should be taken to avoid landing on either a runway or a waterway with the gear in the wrong position, landing on a runway with the gear up tends to be much more benign, with minimal damage and injuries, compared with landing on water with the gear down. Avoiding either scenario is best done by being attentive and not complacent.

Survival aspects

Helicopter underwater escape training (HUET)

HUET has been in use around the world since the 1940s and is considered best practice in the overwater helicopter operating industry. HUET is designed to improve survivability after a helicopter ditches or impacts into water. Fear, anxiety, panic and inaction are the common behavioural responses experienced by occupants during a helicopter accident. In addition to the initial impact, in-rushing water, disorientation, entanglement with debris, unfamiliarity with seatbelt release mechanisms and an inability to reach or open exits have all been cited as problems experienced when attempting to escape from a helicopter following an in-water accident (Rice and Greear, 1973).

The training involves a module (replicate of a helicopter cabin and fuselage) being lowered into a swimming pool to simulate the sinking of a helicopter. The module can rotate upside down and focuses students on bracing for impact, identifying primary and secondary exit points, egressing the wreckage and surfacing.

The ATSB has previously emphasised the importance of HUET for all over-water helicopter operators in other investigations including AO-2018-022, AO-2019-008, AO‑2020-003 and AO-2023-044. Further, HUET is included in the ATSB’s Safety Watch Reducing the severity of injuries in accidents involving small aircraft.

Safety briefing 

The ATSB viewed the safety briefing video and noted it described the operation of door handles from across the operator’s fleet, although the aircraft associated with each handle was not explicitly stated. When the ATSB discussed the briefing process with the passengers, they recalled that the video had a lot of different door handles. One passenger also noted the video seemed to be focused more on helicopters, rather than the floatplane. However, the passengers recalled the pilot briefing them at the aircraft and showing them how the door handles worked on VH‑OHU.

Emergency egress

In this accident, the passengers required assistance from the pilot to egress from the submerged aircraft. Had the pilot been unable to assist, the outcome may have been more severe.

This possibility was reported by the Transportation Safety Board of Canada (TSB) in investigation A09P0397 Loss of control and collision with water involving a DHC‑2 on 29 November 2009. Following the collision with water, the pilot and one passenger survived, however, the other 6 passengers succumbed to injuries from immersion. The report included the following safety issue:

Over the last 20 years, some 70% of fatalities in aircraft that crashed and sank in water were from drowning. Many TSB investigations found that the occupants were conscious and able to move around the cabin before they drowned. In fact, 50% of people who survive a crash cannot exit the aircraft and drown.

The TSB recommended ‘the Department of Transport require that all new and existing commercial seaplanes be fitted with regular and emergency exits that allow rapid egress following a survivable collision with water’ (A11-05).

TSB report A18A0053 Loss of control and collision with water, involving a DHC‑2 on 11 July 2018 noted the aircraft became inverted during the accident sequence. One pilot escaped through the broken front windscreen. The other pilot was unable to open their forward right door nor the cabin door, however, the first pilot was able to open the cabin door from the outside. Neither pilot had undergone emergency egress training, nor was it required. Further, the report included:

Emergency door release mechanisms, better door handles, and push-out windows have been developed for certain types of floatplanes. Some floatplane operators have installed these modifications, but many have not. 

Regulatory requirements for mandatory egress training for commercial floatplane pilots may result in some improvement in emergency egress from commercial seaplanes. However, if the regulator does not mandate or promote voluntary modifications to normal exits, seaplanes will continue to operate with exits that could become unusable following an impact, diminishing the chance occupants have to exit the aircraft following a survivable accident.

Push-out windows

Viking Air Limited (the type certificate holder at that time, now held by De Havilland Aircraft of Canada, see Aircraft information) developed ‘push-out windows’ (Figure 12) and published service bulletin V2/0003 New cabin door windows that incorporate a ‘push-out’ feature in July 2010. The service bulletin noted:

- A series of incidents involving float equipped aircraft has highlighted the need to improve emergency egress from the cabin.

- The Cabin Door Push-Out Window Kits contain a rubber-mounted right-hand and/or left‑hand passenger window which affords additional egress opportunities from the aircraft.

- Viking has designed new windows for the passenger doors that incorporate the same ‘push-out’ feature used for many years on helicopters operating overwater.

- Viking Air Limited strongly recommends that this safety improvement be incorporated on aircraft operating on floats and any wheeled aircraft operating over water, or as directed by the operator’s Regulatory Authority.

Figure 12: Example of main cabin door push-out window

Source: De Havilland Aircraft of Canada and Naomi Lacey (inset), annotated by the ATSB

De Havilland Aircraft of Canada advised it has supplied about 130 kits worldwide, with one kit to Australia. VH‑OHU was not fitted with the push-out windows, nor was it required by regulations.

Revised door latches

Viking Air Limited published service bulletin V2/0004 Installation of an automotive style cabin door latch system in November 2010. The service bulletin cited the reason as ‘the dual automotive (pull) style cabin door latch system provides better egress from the cabin in the event of an emergency’ (Figure 13). The service bulletin also noted:

- Viking Air Limited (Viking) has designed a dual automotive (pull) style cabin door latch system that is more familiar and intuitive to passengers. The existing single latch handle (rotating style) at the rear of the door has been replaced by one pull style latch handle at the same location and a second pull style latch handle in the forward portion of the door. This allows passengers in the forward and rear cabin seats to open the cabin doors in an emergency situation.

- Viking strongly recommends that this safety improvement be incorporated on all DHC‑2 aircraft or as directed by the operator’s Regulatory Authority.

De Havilland Aircraft of Canada advised it had supplied 70 door latch kits to date. VH‑OHU was not fitted with the modified door latch system, nor was it required by regulations.

Figure 13: Representation of revised door latches, with VH‑OHU door in inset

Note: the rotational-style door latch, as was in VH‑OHU, operates in one direction only. Source: De Havilland Aircraft of Canada and the operator, annotated by the ATSB

Similar occurrences

There have been a number of occurrences involving DHC‑2 where one or more wheels were extended during a water landing resulting in the aircraft nosing over and becoming inverted. This has been evidenced in several United States National Transportation Safety Board (NTSB) accident reports as summarised below.

N218RD at Oak Island, Minnesota, on 22 May 2021 (CEN21LA244)

The aircraft departed with a known hydraulic leak in the landing gear system. During the flight, the degraded hydraulic system resulted in the inadvertent extension of the left main gear. This was not identified by the pilot and the aircraft nosed over upon landing on the water and became inverted. The pilot and one passenger were not injured, and one passenger sustained serious injuries.

N9558Q at Stehekin, Washington, on 17 May 2008 (LAX08FA144)

The pilot did not raise the landing gear after take-off. The pilot also reported the flight was turbulent and bumpy, with slow airspeed due to the heavy load. This resulted in numerous AGAS annunciations, until the pilot pulled the circuit breaker to disable the ‘nuisance’ alerts. The pilot intended to reset the AGAS prior to landing but did not do so. When the aircraft landed on the water with the wheels extended, it abruptly nosed over and became inverted. The pilot and 2 passengers survived, and 2 passengers were unable to exit the aircraft and succumbed to immersion. 

N60TF at Sitka, Alaska, on 30 May 2003 (ANC03LA054)

The pilot advised they forgot to raise the landing gear following departure from land. During the water landing, with the wheels extended from the floats, the aircraft nosed down in the water. The pilot was uninjured.

N4478 at Aleknagik, Alaska, on 28 August 2002 (ANC02FA106)

The NTSB found the pilot did not raise the landing gear following departure from land. During the water landing, with the wheels extended from the floats, the aircraft nosed over and became inverted. The 2 passengers escaped with minor injuries and the pilot sustained fatal injuries attributed to immersion.

Safety analysis

Introduction

On the morning of 26 October 2024, the pilot of a De Havilland Aircraft of Canada DHC‑2, registered VH‑OHU, departed Hamilton Island aerodrome, Queensland, with 4 passengers on board for a short scenic flight to Whitehaven Beach, Whitsunday Island. Upon touching down on the water, the aircraft yawed to the right, nosed over and became submerged inverted. The pilot and 4 passengers sustained minor injuries and the aircraft was substantially damaged.

This analysis will discuss the right main gear failing to retract, the unsafe configuration not being identified by the pilot and delayed egress of the passengers. In addition, the analysis will consider why the pilot did not hear the gear annunciation. Further, the pilot’s recent underwater escape training and availability of enhanced egress aircraft modifications will also be discussed.

Right main landing gear failed to retract

Immediately following the accident, the right main gear could be seen extended from the float. Examination of the aircraft found no evidence of leakage, loss or contamination of the hydraulic fluid, and all landing gear circuit breakers were engaged. Further, the nose and left main gear had successfully retracted, indicating the anomaly was likely isolated to the right main gear.

During retraction, the main gear travels aft as it swings up into the float. Had the gear been mid-travel, such as still cycling, the impact with the water would have forced the gear to retract up into the float. Therefore, it was unlikely the right main gear moved during the impact sequence. This was consistent with the post-accident examination, which identified that the right carriage assembly had seized on the slide tube at the almost fully extended position. 

Once removed from the aircraft, forceful removal of the carriage resulted in the identification of advanced corrosion on the right slide tube. The 2 bands of corrosion were coincident with the location of the carriage bushings, near the full gear extension position. This would be expected as the aircraft was predominantly parked on land, with the gear extended.

The investigation considered scenarios conducive to the formation of this corrosion. The maintenance records prior to the aircraft entering Australia in 2015 were not available, as such, the service history of the main gear carriage assemblies, including the bushings, was unknown. While there was a significant difference in the condition of the left and right slide tubes, both tubes were installed at the same time and therefore subject to the same operational and environmental conditions.

The operator advised the aircraft was rinsed with fresh water at the end of the operating day, however, this was not formally recorded and there was no practice for rinsing when the aircraft was not operated for several days. The aircraft records showed the maintainer conducted a 25-hour float inspection on 5 October 2024 and grease was observed on the assemblies during post‑accident examination. However, as there was no requirement to retract the gear for this inspection, the position of the carriage assembly precluded visual examination of the slide tube at the location where the corrosion had developed.

Examination of the carriage bushings identified that the right bushings exhibited more wear and loss of the PTFE ‘sliding layer’, which runs along the slide tube. This had the potential for galvanic corrosion to form, however, required the degradation of the anodised layer on the slide tube to also be present. Insufficient cleaning, inadequate application of grease and/or accumulation of dust or dirt on the slide tube are known contributors to degradation of protective layers. While the extent to which they were contributory in this case was not able to be determined, it was likely that the identified corrosion resulted in the right main gear seizing.

Pilot did not identify extended right main gear

The pilot reported observing 4 blue ‘gear up’ lamps illuminated, at about Tongue Point, and during their pre-landing checks. The passenger footage showed sun glare was not angled in the direction of the landing gear panel and the pilot advised they were able to clearly identify what lamps were illuminated. However, when tested post‑accident, one blue lamp did not illuminate, although it could not be determined if this failure was due to seawater immersion or pre-existing. Further, the location of the failed lamp could not be determined as the lamps were not identified on removal from the landing gear panel. Despite this, failure of any lamp to illuminate requires troubleshooting by the pilot prior to landing. The pilot can readily determine if the lack of illumination of a lamp is due to a failed bulb or other system issue. 

The main right gear UP and DOWN proximity switches tested serviceable during the post-accident examination. The examination also noted the right main gear had unlatched from the DOWN location and moved about 1.5–2 mm in the retract direction before becoming seized. During the landing gear retraction sequence, pressure in the hydraulic system would increase until the pumps automatically switched off and the red ‘in-transit’ lamps would extinguish. In this configuration, with nil movement in the right main gear due to the seizure, it was expected that only 3 blue lamps would have been illuminated. Therefore, the investigation could not reconcile the pilot’s recollection of there being 4 blue lamps illuminated.

The mirror provided an additional method to identify the landing gear configuration. Training pilot 1 advised they could observe all wheels in the mirror following the aircraft repairs. Training pilot 2 reported sometimes experiencing difficulty in observing the right main wheels from the mirror. The accident pilot reported a blind spot, which hindered their ability to see the right main gear in the mirror. However, during the pre‑landing checks, the accident pilot reported they checked the mirror and did not observe any wheels protruding from the floats and continued with the water landing.

Another method to identify the gear position was via the amphibian gear advisory system (AGAS), which provided a visual and audio annunciation as the aircraft slowed for landing. The pilot had been communicating via the radio with the helicopter pilot, thereby showing the audio system in VH‑OHU was operational and that the AGAS annunciation was able to be heard through the headset. However, the pilot reported they could not recall hearing any annunciation prior to landing on the water. Due to disruption of the floats during the accident, the system could not be functionally tested. The pilot advised they were not aware of the pre-flight self-test of the AGAS and therefore this was not conducted prior to the accident flight. While it remained a possibility that the AGAS did not alert the pilot to an asymmetric condition prior to the landing, all 3 pilots reported the AGAS had been functioning correctly in the preceding weeks. Therefore, while it could not be conclusively determined, it was more likely the system was operational.  

The pilot’s 84 water landings in VH‑OHU did not necessarily represent the number of times they had actuated the landing gear, however, they did select the gear to retract after departing Hamilton Island. In addition, the pre-landing checks required the pilot to utilise the aircraft systems to ascertain gear position prior to each landing, regardless if the gear was cycled. Further, the pilot also reported no issues with distractions, workload or experiencing time pressures. 

Therefore, while the aircraft was fitted with multiple systems to confirm the status of the landing gear, for undetermined reasons the pilot did not identify that the configuration was unsuitable for a water landing. This resulted in the aircraft yawing to the right, nosing over and becoming submerged and inverted, a known consequence of water landings with one or more gear extended.

Landing gear annunciator 

The pilot advised the ATSB that they did not recall hearing the AGAS annunciation just prior to the landing. The ATSB’s analysis concluded the AGAS was more likely than not operational at the time of the accident. The investigation therefore considered potential reasons for the audio alert not being heard or being dismissed.

The ‘gear up for water landing’ and ‘gear down for runway landing’ are advisory only and an opportunity for the pilot to check the gear selection matches their intended landing surface. In contrast, the ‘check gear’ annunciation was alerting the pilot that the 4 gear were not all fully up or down and in an unsafe configuration for landing. However, the ‘gear up’ and ‘check gear’ both used a similar female voice and there were no additional tones to indicate the heightened importance of the ‘check gear’ alert. Further, when below the threshold airspeed, the amber ‘gear advisory’ lamp would illuminate, irrespective of the gear configuration. 

The purpose of auditory warnings is to attract attention to a problem (Salvendy & Karwowski, 2021). Ideally, advisory annunciations would sound distinctly different to other alerts to assist pilots to recognise there is problem requiring their action. Making alerts distinctive from other sounds can also inform the pilot of the priority or urgency of the problem (Yeh et al. 2016, FAA, 2016). During approach to land, with the gear in an asymmetric configuration, the AGAS would have enunciated ‘check gear’, indicating an unsafe condition. 

As the pilot would have expected to hear an annunciation with a female voice during landing, there was little to distinguish it from an alert that required action. In addition, the pilot reported they had not heard the ‘check gear’ alert during the training, reinforcing the female annunciation was to be expected and normal. This increased the risk that a pilot would not recognise that the landing gear was in an unsafe condition and removed an opportunity to consider a runway landing, the preferred option in this scenario. However, as the pilot reported not hearing any annunciation prior to landing, there was insufficient evidence to determine if the lack of distinction between the ‘gear up’ and ‘check gear’ annunciations contributed to the accident.

Passengers’ delayed egress

During the accident sequence, the aircraft rapidly filled with water, giving all on board little time to react. Despite being temporarily tangled in their seatbelt, the pilot readily exited the aircraft and swam to the surface. When no passengers appeared, the pilot swam back to the aircraft.

The 2 passengers seated next to the left rear cabin door reported they quickly released their seatbelts, and both attempted to open the door. The pilot was trying to open this door at the same time, without success. The 2 passengers recalled they attempted to locate the right rear cabin door, which was about coincident with the pilot’s decision to also try this door. The pilot managed to open the right rear door and assisted the passengers to the surface. 

The ATSB considered the circumstances that prevented the left rear door from being easily opened following the accident. It was possible that water pressure from the outside was greater than inside the cabin, until equalising as the cabin filled with water. Alternatively, distortion to the airframe during the impact sequence could have prevented door operation. While the reason could not be determined, this contributed to the delayed evacuation from the submerged aircraft.

Underwater escape training

The pilot had completed operator-required helicopter underwater escape training about one month prior to the accident. They attributed this training to their prompt escape from the inverted and submerged aircraft, and subsequent assistance to the passengers. As evidenced in previous ATSB investigations, this training has been shown to significantly increase the chances of survival in the event of a collision with water.

Enhanced egress aircraft modifications

Following multiple similar accidents where occupants initially survived but were subsequently fatally injured from immersion, the Transportation Safety Board of Canada recommended the fitment of regular and emergency exits that allowed rapid egress in the event of a collision with water. Consequently, Viking Air Limited developed push-out windows and more intuitive automotive-style door latches for the main cabin door. These modifications were not fitted to VH‑OHU nor were they required by regulations. 

In this accident, 2 of the passengers were actively searching for a means of escape, but ultimately required the pilot to open the door. However, if the pilot had been unable to assist, the accident could have resulted in dire consequences. Acknowledging that people behave differently in emergency situations, providing an alternative means of escape where one or more doors cannot be opened, increases the chance of survival. This is most relevant with submerged aircraft, yet can also expediate egress for land‑based accidents, particularly those involving a post-accident fire. 

Findings

From the evidence available, the following findings are made with respect to the landing gear malfunction and collision with water involving De Havilland Aircraft of Canada DHC‑2 Beaver, VH‑OHU, near Whitehaven Beach, Whitsunday Island, Queensland, on 26 October 2024. 

Contributing factors

• Likely due to corrosion, the right main landing gear assembly seized near the fully extended position, which prevented retraction after take-off from Hamilton Island.
• During preparations for a water landing, for undetermined reasons, the pilot did not identify the landing gear was in an unsafe condition. As a result, the aircraft landed with the right main wheels extended and then yawed to the right, nosed over and became submerged inverted.

Other factors that increased risk

• The cautionary 'check gear' annunciation was very similar to the advisory annunciation for a normal water landing, increasing the risk that a pilot would not recognise that the landing gear was in an unsafe condition.
• Following the impact, and with the aircraft submerged, the rear left door was unable to be opened by either the pilot or the passengers. As a result, the evacuation of the passengers was delayed.

Other findings

• As required by the operator, the pilot had recently completed helicopter underwater escape training, which aided with their prompt underwater egress and subsequent rescue of the passengers from the inverted and submerged aircraft.
• Push-out windows and door handles designed to expedite egress in an evacuation were available for retrofit on the DHC‑2 Beaver aircraft. VH‑OHU did not have either fitted and nor were they required to by regulation. 

Safety actions

Safety action by Hamilton Island Air

Hamilton Island Air advised the following safety action was undertaken:

• installation of a second mirror on the right wing of its current DHC‑2 aircraft
• formal initial and refresher training on the pilot maintenance tasks
• implementation of a daily washdown and preventative maintenance procedure checklist, which included a sign-off section to formally record when the activities were completed and by whom
• implementation of a minimum weekly systems check flight, including landing gear cycle, where the aircraft had not been recently operated
• implemented initial and annual theory ground school training, flight characteristics training and 180-day proficiency flight checks for all floatplane pilots, conducted by authorised flight training organisations.

Safety action by the Civil Aviation Safety Authority

Following review of the draft investigation report, the Civil Aviation Safety Authority advised it was intending to release airworthiness bulletin AWB 32-029 Issue 1 Supplementary Type Certificated Amphibian Float Main Gear Slide Wear in Marine Environments. Reflecting the information contained in the ATSB’s investigation report, the bulletin contains advice to operators and maintainers highlighting the importance of inspection and preventative maintenance aspects for retractable landing gear carriages fitted to amphibious aircraft when operated in a marine environment. The bulletin recommended that:

• during scheduled maintenance of the landing gear, particular attention should be applied during a visual inspection for evidence of corrosion or mechanical damage to the hard anodized surface of the slide tubes
• during periods of extended non-service, the landing gear slide tubes are lubricated and visually inspected for damage along their full length prior to the aircraft returning to service
• during approved pilot maintenance. the main gear slide tubes are wiped clean and lubricated and the gear carriages are completely refreshed with clean grease. 

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and passengers of the accident flight
• the operator and training pilots
• the Civil Aviation Safety Authority
• De Havilland Aircraft of Canada
• Wipaire
• the maintenance organisation for VH‑OHU
• the maintenance facility that conducted the post-accident aircraft examination
• Bureau of Meteorology
• video footage from the accident flight and other photographs taken on the day of the accident.

References

Federal Aviation Administration. (2016). Human factors design standards. US Department of Transportation, United Sates Government.

Rice, E,V., & Greear, J.F. (1973). Underwater escape from helicopters. In Proceedings of the Eleventh Annual Symposium, Phoenix, AZ: Survival and Flight Equipment Association, 59-60. Cited in Brooks C. (1989) The Human Factors relating to escape and survival from helicopters ditching in water, AGRAD.

Salvendy, G., & Karwowski, W. (2021). Handbook of human factors and ergonomics (5th ed.). John Wiley & Sons, Inc, doi: 10.1002/9781119636113.

Yeh, M., Swider, C., Jin Jo, Y., & Donovan, C. (2016). Human factors considerations in the design and evaluation of flight deck displays and controls. Federal Aviation Administration, United States Government.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the pilot of the accident flight
• the operator and training pilots
• the maintainer of VH‑OHU
• Civil Aviation Safety Authority
• De Havilland Aircraft of Canada
• Transportation Safety Board of Canada
• Wipaire
• United States National Transportation Safety Board.

Submissions were received from:

• the operator
• De Havilland Aircraft of Canada
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.