In the early afternoon of 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA), was conducting test flights following aircraft maintenance. After completing a successful autonomous test flight, the pilot toggled the automatic mode switch to disengage the aircraft’s automatic mode for taxi back to the hangar.
The pilot then increased the throttle to provide the aircraft with sufficient momentum to taxi. As the aircraft turned towards the pilot, they determined that the aircraft was not responding to commands to reduce the engine thrust. The pilot considered attempting to arrest the aircraft by hand but determined it was moving too quickly and instead toggled the automatic mode switch to regain control of the aircraft and turn it away from bystanders.
The pilot then directed the aircraft across the airfield and it came to rest against the perimeter fence, resulting in minor damage to the aircraft’s skin.
What the ATSB found
The ATSB determined that, following the autonomous flight, the pilot did not correctly disengage the aircraft’s automatic mode. Subsequently, when they increased the throttle to provide the aircraft with momentum to taxi back to the hangar the ’abort landing’ function activated, increasing the throttle to maximum and overriding the pilot’s commands to decrease throttle. The pilot was able to deactivate the ’abort landing’ function by toggling the automatic mode switch.
It was determined that the pilot did not identify visual, audible and tactile cues that indicated the aircraft had not exited the automatic mode prior to increasing the throttle for taxi. The most likely reason for this was that they were experiencing a level of fatigue known to impact performance.
Additionally, the pilot’s controller utilised switches with 3‑positions for 2‑position (on – off) roles, increasing the likelihood of incorrect or incomplete selection. The controller also lacked the means to enable the pilot to immediately shut down the aircraft’s engine.
What has been done as a result
In response to this incident the operator implemented several changes to their systems and procedures. They advised that 3‑position switches on the aircraft controllers, which were being used for 2‑position roles, have been replaced with 2‑position switches. A formalised taxi-in procedure has been introduced that requires personnel to shutdown aircraft on the runway and push them to the hangar by hand. A gated switch was installed on the remote controller that was capable of overriding all other controls, placing the flight controller into manual mode and commanding the throttle to shut down the turbine engine.
For subsequent operations the flight test timeline was increased from 7 to 10 days with no increase in workload. The additional time was to allow for aircraft setup and testing prior to operations commencing and to ensure that all crew members were provided with adequate rest and recovery time during both setup and operations.
Safety message
This incident has 3 key learnings for RPA operators:
Fatigue is a risk, particularly in high tempo commercial operations. Even when fatigue management is not mandated, operators should ensure that their fatigue management processes are robust and effective.
All controls for RPA’s should be as simple and reliable as possible. If a control leaves room for human error, then it will increase the risk of this error occurring even if procedural controls are in place. Consideration should also be given to a system that allows the remote pilot to shut down the aircraft immediately in the event of an unexpected state or failure.
Operators should be prepared for the RPA to do something unexpected and know and frequently practice emergency procedures.
The occurrence
On the weekend of 13‑14 June 2020 a team of remote pilots and maintainers from Remote Piloted Systems (the operator), RF Designs (the maintainer) and a client company arrived at Bruhl Airfield, 2 km south-west of Tara, Queensland (Figure 1). Over the weekend they set up and prepared for a week of test flying of two autonomous test bed aircraft, the RF Designs Albatross and the RF Designs Mephisto (Mephisto). The aircraft were assembled, following disassembly for transport, and systems tested prior to operations commencing on the Monday morning. This work was overseen by the operator’s chief remote pilot (CRP) and a senior manager of the maintainer.
Figure 1: Location of Bruhl Airfield
Source: Google Earth annotated by the ATSB
Throughout the following week the team conducted multiple test and evaluation flights for the client each day. These usually involved multiple aircraft and multiple pilots through the launch (take-off), mission, and recovery (landing) phases.
On the morning of Friday 19 June, the final operational flights were carried out for the client company. Following this, the client’s personnel commenced packing up and preparing to depart the site. With all relevant permissions and approvals in place, the operator’s CRP took the opportunity to conduct post maintenance test flights on Mephisto HP001, to ensure that it was airworthy and prepared for future operations. During the week, HP001 had undergone maintenance which included the aircraft’s flight controller being removed and reinstalled following its use in another Mephisto aircraft.
The flight plan for the test consisted of two flights, testing all three of the aircraft’s modes (see the section titled Aircraft operations), and the flight controller setup and tuning. The first flight was to involve a launch in manual mode, followed by a circuit and recovery in fly by wire (FBW) mode. If the results of this flight were acceptable the aircraft was to be repositioned to the western end of the runway for the second flight. There it would be transitioned to autonomous mode and conduct a fully autonomous launch, circuit, and recovery.
At 1242 Eastern Standard Time,[1] HP001 was launched, with both flights completed without incident. Figure 2 shows the Global Positioning System (GPS) tracks of the aircraft during the first and second flights with the track colour indicating the aircraft’s mode. Figure 3 shows the transition between the flights and the completion of the second flight, the initial taxi, loss of control and the recovery.
Figure 2: Mephisto test flights 19 June 2020
Source: Google Earth and operator annotated by the ATSB
Following the autonomous recovery at the conclusion of the second test flight, the pilot attempted to transition the aircraft out of the autonomous mode and back into manual mode for taxi to the hangar. The pilot toggled the automatic mode switch and increased the throttle setting to provide thrust to taxi the aircraft. Once the aircraft had sufficient momentum to allow for the taxi the pilot attempted to reduce the throttle setting. However, the aircraft did not respond to the pilot’s commands and the turbine engine continued to accelerate.
The aircraft was now in relatively close proximity to the pilot and moving towards other personnel who had been observing from nearby. The pilot considered arresting the aircraft by hand but, due to the aircraft’s speed and momentum, they determined that was not practical. The pilot re‑toggled the automatic mode switch, allowing them to regain control. With the aircraft back under control, the pilot directed the aircraft across the runway to the southern side of the airfield away from the hangar and personnel. The aircraft was arrested, at low speed, by the airfield boundary fence.
The aircraft was then attended by the pilot and several other personnel who conducted a normal shutdown before pushing it back to the hangar for inspection. The inspection determined that the aircraft only had minor damage to the skin due to the impact with the fence.
Figure 3: Mephisto test flight 2 - occurrence flight
Source: Google Earth and operator annotated by the ATSB
The RF Designs Mephisto remotely piloted aircraft (RPA) (Figure 4) is a high-performance autonomous testbed aircraft. First flown in 2019, it is based on the CARF-Models Mephisto large model aircraft and modified by RF Designs at their facility in Brisbane. These modifications included a flight controller, additional fuel tank, additional shielded wiring, and some larger and more robust control components, all allowing for autonomous test operations.
Figure 4: RF Designs Mephisto
Source: RF Designs
The aircraft, which can be disassembled for transport, is a composite construction of carbon fibre and fibreglass, 3.1 m long, with a wingspan of 2.6 m. It has a maximum take-off weight of 35 kg, retractable undercarriage and flaps and is powered by a Kingtech K260G2 turbine. Delivering 26 kg of thrust, the turbine can propel the aircraft to a maximum speed of 85 m/s (165 kt) and an altitude of more than 5,000 feet.[2]
The client owned a fleet of 6 of the aircraft that were operated and maintained by Remote Piloted Systems and RF Designs respectively. Of the fleet, 5 were operationally capable (Figure 5), and 1 (HP001) was used for testing and training.
For the week of 15‑19 June the operator brought 4 of the fleet to conduct operations for the client, 3 operational Mephistos and the test and training aircraft for backup and spare parts.
Figure 5: Operational Mephisto fleet
Source: RF Designs
Aircraft operations
The Mephisto could be operated in three different modes, manual, fly by wire (FBW) or automatic.
In manual mode the remote pilot in command (RPIC) had full control over all aircraft functionality with no interaction from the flight controller’s stabilisation programming. This required that the aircraft be manually trimmed and stabilised by the RPIC. In FBW mode the RPIC commanded the aircraft directly, however, the flight controller’s stabilisation programming interpreted and implemented these commands to ensure stable flight. This meant that if the pilot removed control input, then the aircraft would continue in straight and level flight.
Finally, in automatic mode a flight plan consisting of a series of waypoints was programmed into the flight controller using the ground control station (GCS). When the RPIC activated the automatic mode and the flight plan, the flight controller commanded the aircraft through the programmed waypoints with full control over aircraft systems. When the automatic mode was disengaged the aircraft’s systems return to the settings commanded by the RPIC’s controller.
The crew of the Mephisto consisted of two remote pilots - the launch and recovery pilot (LRP) and the GCS operator. The pilot who was actively flying the aircraft was designated the RPIC. For the autonomous flights the RPIC was the GCS operator as they were monitoring the flight and had the ability to intervene and take control of the aircraft if required.
The LRP primarily conducted launches and recoveries and operated the aircraft in manual or FBW mode within visual line of sight. This usually involved flying the aircraft to or from a holding point where it was transitioned to or from the command of the GCS operator for automated flight.
The GCS operator monitored aircraft systems during all flights, conducted flights beyond visual line of sight (BVLOS) and monitored automatic flights. Due to the difference in their roles the LRP and GCS operator were located at different points on the field (Figure 3). The LRP was on the flight line next to the runway providing them the best view of the aircraft for launch and recovery. The GCS operator worked from inside a hangar which provided a more stable environment for the equipment used to monitor and control the aircraft while away from the launch and recovery location. Due to their physical separation, the pilots communicated via radio.
Due to the risk to the aircraft of an inadvertent mode change when transitioning from the GCS operator to the LRP following a flight, a specific process was used for the handover. This process started after launch once the LRP handed over control to the GCS operator. At this point, the LRP would place the automatic mode switch (see the section titled Remote controller) on their controller in ’auto on’ and set the flaps to fully retracted.
At the time of the occurrence, following the automated test flight, the GCS operator had handed control back to the LRP for taxi. The pilot advised that prior to the hand over their controller had been set up with the automatic mode switch selected to ’auto on’ and the flap control in the fully retracted position.
Flight controller
Each Mephisto aircraft was fitted with a Pixhawk 2 flight controller, which was programmed with ARDUpilot software to enable flight in all modes. The flight controller recorded a range of parameters which could be downloaded and used for simulation, recreation, and analysis.
The flight controller received a constant stream of data from a range of inputs including control inputs from either the LRP remote controller or GCS, GPS information, airspeed and engine fuel flow. It then controlled the aircraft via a series of servos that manipulated the aircraft flight control surfaces and turbine engine controls.
Abort landing command
The ’abort landing’ command within the flight controllers programming allowed the GCS operator or LRP to abort an autonomous landing via the remote controller or GCS. The LRP controller triggered the command when 3 criteria were met.
- The aircraft was in the autonomous mode.
- The aircraft was in the landing stage.
- The throttle on the LRP controller was increased above 90 %.
When these criteria were met the aircraft overrode control inputs, increased turbine power to the take-off throttle setting (100 %), pitched up and maintained the current heading until a target altitude was reached.
Remote controller
To control the Mephisto the LRP used a TARANIS X9D Plus hand-held controller, manufactured by FrSKY. The TARANIS X9D Plus (Figure 6) was a programmable, 24 channel, 2.4 GHz transmitter that could be used to control a range of remote devices, including RPA. The controller had 8 programmable control switches, (6 3-position and 2 2-position) that the user could assign to modes or operational settings.
For this operation, to ensure redundancy, the 2 position switches activated the ’return to launch’[3](RTL) function. This meant that 3 position switches were used to control the aircraft’s modes. To reduce risk of the automatic mode being inadvertently deactivated the modes were switched separately. One switch controlled the automatic mode (on and off) and the other selected manual or FBW. The control hierarchy placed the automatic mode switch above the manual or FBW switch so an inadvertent movement of the manual or FBW switch would not disengage the automatic mode.
Figure 6 shows the location of these switches. The operation of any of these switches required a defined movement and the pilot described that changing between positions made an audible ’click’.
The automatic mode switch was configured with 2 ’auto on’ and 1 ’auto off’ position, which was the top position. This configuration had recently been updated from 1 ’auto on’ and 2 ’auto off’ positions. This change was due to a risk to the aircraft associated with inadvertent deactivation of the automatic mode during flight, particularly when the aircraft was BVLOS. To ensure that the switch was in the correct position it was normal for pilots to drive the switch to an end point of the control to ensure that the desired mode had been selected.
The LRP controller was not fitted with the ability to activate the aircraft’s flight termination system (FTS) (see the following section titled Flight termination systems and active failsafe) or operate as a ’kill switch’, cutting power the aircraft’s engine. In the event that the LRP required the FTS to be activated they would request the GCS operator activate it.
Figure 6: TARANIS X9D Plus with key controls identified
Source: FrSKY annotated by the ATSB
Flight termination systems and active failsafe
Under the Civil Aviation Safety Authority (CASA) permission for the operation (see the section titled Operational information) the aircraft was required to be fitted with a primary active failsafe system and primary and secondary flight termination systems. The primary active failsafe system was designed to ensure that the aircraft did not depart the operational area in the event of a communications loss with the controller. It was designed to return the aircraft to either the launch point or some other holding point within the operational area that allowed the RPIC to conduct necessary checks and perform relevant actions to re-establish communications. If necessary, the system could be activated by the LRP, GCS operator or automatically if the aircraft exited the operational area. The aircraft’s RTL function met this requirement.
The FTS was a secondary level of control that was activated if the primary active failsafe failed or was unable to return the aircraft to a stable location. The system worked by bringing the aircraft to the ground as quickly and as safely as possible, with the main aim of protecting personnel and property. In the case of the Mephisto, the FTS was set to place the aircraft flight control surfaces in a configuration to induce a spin and cut fuel to the engine. This arrested as much forward momentum as possible prior to impact with terrain. The FTS was activated by either the GCS on a dedicated control link or automatically if the aircraft departed a contingency area around the operational area.
CASA specifically stated that the FTS was not intended for use on the ground. However, the system’s process meant that, in the event of an issue on the ground, it would provide a way to rapidly arrest momentum of the aircraft and put it into a known state.
At the time of the incident the aircraft in question was fitted with both the primary active failsafe and FTS. However, due to the rapid development of the aircraft the flight manual had not been updated and contained information that the flight termination system had not been fitted and remained in development.
Operational information
The operator, maintainer and client company had been conducting BVLOS, autonomous and multi-aircraft test flights from Bruhl airfield since November 2019. They had been using a range of smaller, primarily electrically driven aircraft types and recently began using the Mephisto, to allow for higher performance operations and testing.
Bruhl airfield, located approximately 265 km west-north-west of Brisbane Airport (Figure 1), was chosen for 3 reasons. Firstly, it was familiar to several of the crew members. Secondly, it was remote and the surrounding area desolate. This meant that the operational area had a low the risk to persons and property in the event of an aircraft malfunction. Finally, it was accessible by road for the operator, maintainer, and client company from Brisbane.
Operational permissions
Permission for autonomous, BVLOS, multi-aircraft operations at Bruhl airfield operations was granted by the CASA in November 2019. The operator was authorised for flight BVLOS above 400 ft within defined areas and in compliance with certain conditions until 30 November 2020 or revoked. These conditions included:
the fitment of a ’primary failsafe mode’ which could command a return to launch, ensuring that, during this process, the aircraft did not increase height or depart from the operational area
fitment of both primary and secondary flight termination systems, with the secondary being able to command immediate flight termination in the event of the loss of communications with the primary.
Operational schedule
Operational test flights for the client’s systems were carried out throughout the week, finishing prior to the incident flight at approximately midday. Through the week these operations started at around 0900 and continued throughout the day, with a break for lunch.
Following each flight there was the requirement to download and analyse the aircraft flight data, liaise with the client company, conduct any required maintenance, and prepare aircraft and flight plans for following flights. These tasks were usually carried out by the incident pilot in their role as the operators CRP.
There was no formalised procedure for taxiing the aircraft back to the hangar. However, the pilot reported that there was a standard process that Mephisto pilots followed to provide the aircraft with enough momentum for the taxi. This process, as outlined below, was for a Mephisto aircraft having completed an autonomous recovery and positioned on the runway.
LRP to take control of the aircraft.
automatic mode to be deactivated with the aircraft in either FBW or manual
remote controller throttle advanced to 100 %
pilot to wait for the throttle to spool up to the desired level (approximately 30 %), due to throttle lag this could take approximately 6-7 seconds
pilot to throttle back on the controller to desired level
pilot to taxi the aircraft back to the hangar under its own power.
Crew information
A team of five pilots, all cross trained on the GCS and as LRP for the Mephisto aircraft, were available to conduct the week of flight activity. In addition, at the time of the incident, multiple training pilots were observing the test flight in preparation for CASA flight testing during the following operational period.
For the incident flight the aircraft crew consisted of the LRP, who was also the operator’s CRP, and a GCS operator. Both the LRP and GCS operator held current remote pilot licenses (RePLs) with appropriate category and type endorsements for operation of the Mephisto.
Fatigue
The International Civil Aviation Organization (2016) defined fatigue as:
A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.
Fatigue is a known contributor to a range of adverse effects on human performance. These can include, slower reaction times, decreased vigilance, shortened attention span, reduced short term memory capacity, and reduced decision making capability.
The pilot reported that at the time of the incident they, and others undertaking the operation, were experiencing a heightened level of fatigue due to the tempo of the operation.
Three people on site were designated to monitor fatigue of the operational crew, the incident pilot (as the operators CRP), a senior manager of the maintainer’s company, and a representative from the client company. The pilot reported that following an out‑landing incident earlier in the week, the client’s fatigue management personnel reported that they believed that there was a heightened level of fatigue among the operational personnel. This increased awareness of the fatigue levels prompted increased monitoring of the crew. However, no further action was deemed to be necessary.
Fatigue guidance
At the time of the incident, there was no regulation that applied to fatigue management for operators of RPA. However, in the company operations manual, the operator had used guidance from CASA's sample operations manual, which identified the following 3 areas of fatigue management to be followed:
the chief pilot must consider and minimise the potential for fatigue to effect operations
pilots were not to conduct RPAS operations if they believed that they were suffering from fatigue that was likely to impair their performance
pilots must immediately report fatigue related concerns to the chief pilot who would take appropriate action to remedy the situation.
To comply with this, the chief pilot was required to consider several factors relating to each mission, including:
travel time to the operation
complexity and duration of the operation
the time of day that the operation was to take place
environmental conditions.
Fatiguing conditions
Through a review of the operation and the pilot’s history the ATSB identified 3 factors that could have contributed to a significantly heightened fatigue level. These were environmental conditions, operational requirements, and disrupted sleep.
Environmentally, while the incident occurred during winter, the LRP were operating outside on the flight line, in sunny and warm conditions. While there was no concern about the effect of the temperature, the pilots did identify a risk of dehydration, which can be a contributor to fatigue. These factors were being managed through breaks through the day and access to shade, fluids and food.
Operationally there were 2 periods that would have affected the pilots fatigue levels. Firstly, in the week leading up to the operation the pilot had been undertaking a range of maintenance testing and other preparatory activities. This involved multiple round trips to and from Brisbane to the airfield for test flights, a trip of approximately 3 hours each way. In addition to the flights and aircraft preparation this also involved data download, analysis and associated aircraft tuning both at the airfield and in Brisbane.
These activities were not only fatiguing themselves but limited the pilot’s opportunity for rest in preparation for the operational week, which they were aware was going to have an increased operational tempo. The pilot was aware of the heightened risk of fatigue due to these factors and sought to mitigate them over the weekend prior to the operation by taking more of an oversight role of preparations and leaving individual tasks to crew members.
The pilot reported that during the operational week they had 12 to 14 hours of duty each day. This involved carrying out aircraft test flights for the client company, overseeing LRP and GCS operations for the operational and test aircraft. In their role as CRP, the incident pilot, was also monitoring the crew for signs of fatigue, overseeing maintenance, preparing aircraft, and planning and reviewing data for the operations undertaken each day. The maintenance and preparatory tasks were undertaken in the morning prior to commencement of the days flying operations and, in the evening, following the completion of operations until going to sleep. This meant that, with the exception of mealtimes, there was limited to no time where the operations were not the focus. While the incident occurred in the middle of the day it was at the end of the final test flight of the week’s operations.
The pilot reported that sleep opportunity was in line with their regular habits, getting approximately 7 hours each night. However, during these operations they were staying at the airfield and rooming with another person. The pilot reported that this probably resulted in disrupted sleep. All other members of the crew were roomed off site in individual accommodation, which both promoted sleep opportunity and removed them from the operational environment.
Fatigue review
Unlike crewed aircraft operations, this operation did not need to comply with Civil Aviation Order (CAO) 48.1 Instrument 2019. Despite that, the ATSB reviewed the pilot flight and duty times against the instrument and appendices 1 (basic limits), 4 (any operations) and 5A (daylight aerial work operations and flight training associated with aerial work) to gain an appreciation of what level of fatigue was considered likely to affect performance.
Based on this review it was determined the pilot had exceeded the cumulative duty period limits, had not had sufficient off duty time and did not have adequate sleeping facilities as per the instrument requirements. As such, if the pilot had been seeking to fly a crewed aircraft subject to CAO 48.1 requirements, they would have been considered unfit to fly.
Recorded data
As discussed in the Flight controller section, the Pixhawk 2 flight controller can record and store a range of timestamped flight data and status messages.
The data for the two test flights, was downloaded by the operator and the data and relevant software for interpreting it were provided to the ATSB. Figure 7 shows data from these flights with throttle, flap and altitude traces. Additionally, the active aircraft mode is shown and some of the recorded aircraft status messages.
Figure 7: Flight data showing 19 June test flights
Source: ATSB utilising data provided by the operator
Figure 8 shows data from the second flight with the transition into automatic mode and the aircraft then launching conducting a circuit and being recovered. Following the landing there were a number of mode changes and an aircraft status message that corresponded with the ‘abort landing’ function being activated, the pilot toggling the mode switch to disengage this function and directing the aircraft away from personnel on the flight line.
Figure 8: Flight Data - Mephisto test flight 2 - 19 June
Source: ATSB utilising data provided by the operator
Figure 9 shows greater detail of the incident over the period of 20 seconds from 12:47:00 to 12:47:20, during which the aircraft was under the control of the LRP. This time covers the aircraft on the ground preparing to taxi, the throttle being advanced, and the ’abort landing’ function being activated, as identified by aircraft status message 2. It shows the mode selections by the pilot as they disengaged the abort landing function and toggled into manual mode as the aircraft was directed towards the airfield fence.
The chart shows that the aircraft remained in automatic mode and the flaps remained extended until approximately 12:47:04 when the throttle trace showed an increase to 100 %. At this time the aircraft status message appeared, giving the indication that the ’abort landing’ function has been activated and the flaps retracted while the throttle remained at 100 % as the aircraft followed the ’abort landing’ process.
The data showed the pilot toggling the automatic mode switch to off, and back on, to overwrite the ’abort landing’ function. It shows the throttle trace as the pilot directed the aircraft away from the flight line and across the runway towards the fence, and finally the re-engagement of the manual mode for the aircraft to be shutdown.
Figure 9: Flight Data - Incident - 19 June
Source: ATSB utilising data provided by the operator
At 1247 on 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA) completed an automated test flight and attempted to transition the aircraft out of automatic mode to taxi it back to the hangar.
The pilot was unaware they had not deactivated the aircraft’s automatic mode prior to increasing the throttle to provide sufficient momentum for the taxi. This action activated the aircraft’s ‘abort landing’ function and prevented the engine from throttling down as the pilot was commanding.
The following analysis will look at the factors that resulted in the incomplete deactivation of the automatic mode, the pilot not realising the aircraft remained in the automatic mode and the delay in regaining control of the aircraft.
Deactivation of automatic mode
Following the landing, the pilot attempted to deactivate the aircraft’s automatic mode using the automatic mode switch. The switch had 3 positions with 2 positions set for automatic mode on and 1 for automatic mode off. The pilot recalled that they had moved the switch as indicated by the click and movement that was felt. However, they did not recall whether it was moved 2 positions or 1. The data showed no deactivation of the autonomous mode, indicating a single position change.
This meant the aircraft was in a state different to what was intended leading to the activation of the ’abort landing’ function when the pilot advance the throttle, and the subsequent loss of control.
The LRP remote controller (TRANSIS X9D Plus) had only two 2-position switches available, which for redundancy were both being used for return to launch functionality. This meant that the automatic mode selection was relegated to a 3-position switch. The technique of driving the switch to an end point that the Mephisto pilots used went some way towards mitigation of an error. However, the use of a 3-position switch increased the likelihood of a mis-selection and an undesired state.
This potential had been identified by the operator with the change of layout for the 3 positions from off-off-on to off-on-on. It was believed that this was a way to limit the risk of an aircraft accidentally being forced into manual or fly by wire mode while flying beyond visual line of sight. However, it did not overcome the issue of an incomplete or incorrect mode selection.
Aircraft state awareness
There were 3 cues to alert the pilot that the aircraft remained in the automatic mode. Firstly, the aircraft’s flaps had not retracted when they attempted to disengage the automatic mode, despite being set to fully retracted on the controller. Secondly, the pilot should have felt and heard two distinct ’clicks’ as the control moved through the second ’auto on’ position and into the desired ’auto off’ position.
The pilot commented that they did not remember seeing the flaps retract and recalled feeling and hearing 1 click but could not recall the second. The ATSB considered a number of reasons why the pilot may not have detected or reacted to these cues. These included: deliberate pilot action, distraction, expectation bias, and fatigue. Based on the available evidence, it was considered that the heightened level of fatigue was the most likely explanation. This is discussed further below.
Delayed control recovery
In the event of a RPA loss of control on the ground, where the engine was still functioning at a high-power setting, removing engine power is the quickest and easiest way to arrest momentum and bring the aircraft back under control. The flight termination system (FTS), as required under the CASA permission for the operation and fitted to the aircraft, provided the ability override the aircraft’s automatic mode, immediately cut fuel to the turbine and drive the aircraft controls into a configuration to induce a spin.
While this system was designed to operate in the air, its functionality, specifically cutting fuel to the turbine, would have allowed the aircraft’s momentum to be arrested more quickly. However, this system could not be activated from the launch and recovery pilot’s (LRP) controller and relied on communications with the ground control station operator to activate it. The aircraft’s data showed that there were only seconds for the pilot to react and take appropriate action. While calling for the activation of FTS would have stopped the aircraft it would not have been practical in the time available.
Had the LRP’s controller been fitted with a switch that could activate the FTS, there would have been no requirement for the extra control inputs to deactivate the ‘abort landing’ function and regain control of the aircraft.
Fatigue
For this operation the potential effects of fatigue on crew members had been identified and a range of fatigue management and mitigation strategies were in place. However, these strategies did not specifically account for the added work created by the incident pilot’s additional role as the operator’s chief remote pilot (CRP).
For example, in addition to flight operations and testing, they were liaising with the client company, monitoring other team members for signs of fatigue and staying at the field in shared accommodations. Additionally, while the crew was being monitored for fatigue, the 3 personnel assigned to monitor the fatigue - the CRP, the maintainers senior manager and the clients fatigue monitoring personnel did not have anyone assigned to monitor their fatigue levels. Fatigue monitoring is only effective if all personnel are being monitored.
Considering their workload and reduced rest opportunity, the ATSB assessed that it was likely that the pilot was experiencing a level of fatigue that affected performance. Heightened fatigue levels are known to cause a reduction in ability to react to external stimuli and effect a person’s attention and decision-making capacity.
The level of fatigue felt by the pilot at the time of the incident likely had an effect on them missing the visual (flaps not retracting), tactile (not feeling one click rather than two) and audible cues (hearing one click not two) that indicated the aircraft had not exited the automatic mode.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the loss of control during taxi involving RF Designs Mephisto, HP001 at Bruhl Airfield on 19 June 2020.
Contributing factors
When the throttle was advanced for taxi, the automatic mode, which had not been correctly deactivated, entered an ’abort landing’ state. This overrode the pilot’s commands to decrease throttle and the turbine thrust continued to increase, resulting in a loss of control.
The use of a 3-position switch (with 2 positive and 1 negative position), for a 2‑position role, increased the likelihood that a pilot would inadvertently not deactivate the automatic mode prior to manoeuvring the aircraft.
The controller did not have a ’kill switch’ to override the aircraft’s automatic mode and shutdown the turbine in the event of an issue. As a result, the pilot was forced to toggle the aircraft’s mode switches and direct it away from personnel rather than being able to override it.
The pilot was experiencing a level of fatigue known to impact performance. This likely led to a lack of reaction to multiple cues that the aircraft had not exited the automatic mode.
Safety action
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Safety action by Remote Piloted Systems (the operator).
In response to this incident the operator introduced the following changes to the Launch and Recovery pilot’s controller switch layout and allocations, procedures for taxiing the Mephisto aircraft and operational planning to reduce risks identified:
3‑position mode switches were replaced with 2‑position mode selection switches to eliminate issues with incomplete deactivation of the automatic mode.
All launch and recovery pilot controllers had a ’kill switch’ added that overwrites the aircraft’s mode to manual and drives the throttle immediately to zero thrust. This switch is gated to enable easy to operation, when necessary, but is also difficult to inadvertently activate.
Taxi procedure has been changed/formalised to require that all aircraft are shutdown on the runway and pushed back to the hangar by hand rather than under their own power.
The operational timeline has been extended from 7 to 10 days, with additional time to setup and prepare the aircraft and a break before operations commenced.
Safety action by RF Designs (the maintainer).
Since this event the RF Designs has introduced the following two safety improvements:
The aircraft flight manual has been updated to clarify the presence of the flight termination system, removing the phrase ’not currently fitted, in development’.
Specific fatigue management requirements, including references to CAO-48.1, have been added to the RPA operations manual.
The ATSB welcomes the prompt safety action taken by the operator and maintainer to address the deficiencies identified in this incident.
Glossary
BVLOS Beyond Visual Line of Sight
CASA Civil Aviation Safety Authority
CRP Chief Remote Pilot
FBW Fly by Wire
FTS Flight Termination System
GCS Ground Control Station
GPS Global Positioning System
LRP Launch and Recovery Pilot
RePL Remote Pilot License
RPA Remotely Piloted Aircraft
RPIC Remote Pilot in Command
RTL Return to Launch
Sources and submissions
Sources of information
The sources of information during the investigation included the:
pilot flying
aircraft manufacturer and maintainer
Civil Aviation Safety Authority
Operators manual for the FRSky TARANIS X9D Plus
recorded data from the aircraft
ARDUpilot documentation.
References
ICAO. (2016). Doc 9966: Manual for the Oversight of Fatigue Management Approaches 2nd Edition. Quebec, Canada: International Civil Aviation Organisation.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the operator and pilot flying
the maintenance organisation
CASA
No submissions were received.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2020-035
Occurrence date
19/06/2020
Location
Bruhl Airfield (2 km south west of Tara, Queensland)
On the morning of 12 December 2019, a student pilot took off for a series of solo circuits in a BRM Aero Bristell, registered VH-YVF, at Moorabbin Airport, Victoria. Just after crossing the runway threshold for the first touch and go landing, witnesses observed the aircraft about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted.
The witnesses described what they saw as similar to the aircraft being in the first half rotation of a spin entry. The nose then dropped and the aircraft impacted terrain in a steep inverted attitude. The student pilot was severely injured, and the aircraft was destroyed.
What the ATSB found
The ATSB found that the pilot commenced a go‑around at low level when the aircraft deviated from the runway centreline in crosswind conditions. During the go‑around, the aircraft aerodynamically stalled and commenced a spin.
It was also identified that the student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.
Finally, the required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.
What has been done as a result
Soar Aviation implemented enhanced measures to ensure student pilots were fully briefed and authorised, before conducting a solo flight. These amended procedures included changes to the aircraft booking procedure and having aircraft keys stored such that they were only accessible by flight instructors.
Soar Aviation ceased flight training on 29 December 2020.
Safety message
Familiarity with an aircraft’s specific systems, controls, handling and limitations is essential for safe flight.
Safety-critical procedures and regulations are in place to ensure that pilots have the required level of skill and experience to safely operate an aircraft. The outcome of this accident, which could just as easily have been fatal, illustrates a consequence of deviating from them.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
On the morning of 12 December 2019, a student pilot conducted a pre-flight inspection of a BRM Aero Bristell S-LSA,[1] registered VH-YVF, in preparation for a solo flight. A second student (student 2) also conducted a pre-flight inspection of their aircraft at the same time and, after completing their aircraft checks, they returned together to the flight school’s main building. Student 2 reported they then ‘walked into navigation planning to organise dispatch of my flight’ however, they observed that the other student pilot did not. Student 2 later observed the student pilot walking back to the where the aircraft were parked, with their ‘flight bag and aircraft folder’.
The student pilot had the aircraft keys however, they had not endorsed the aircraft’s maintenance release or conducted the required solo flight briefing and sign out procedure with a flight instructor. The student pilot stated to the ATSB that they believed they were authorised for the solo flight. However, they also reported a level of confusion as to whether the solo dispatch procedure was required at their stage of training.
At 0950 Eastern Daylight-saving Time,[2] the student pilot was cleared by air traffic control (ATC) to take off from runway 17L[3] at Moorabbin Airport, Victoria, for a series of circuits. The pilot reported feeling ‘uncomfortable’, with the aircraft and its systems during the flight, and that they surmised this was due to their limited experience in the Bristell.
While on the downwind leg of the first circuit, the student pilot advised ATC of their intent to conduct a touch and go, which was subsequently cleared at 0954. During the approach to the runway, the student pilot described that they felt the nose ‘wanted to pitch up’, even though they believed the aircraft was neutrally trimmed.
The student pilot stated that, just after crossing the runway threshold, what felt like a sudden gust of wind pushed the aircraft to the left of the runway centreline. At that point, the student pilot decided to initiate a go-around. The pilot reported that, after commencing the go-around. the aircraft was then ‘ripped up very violently, straight up into the air and then ripped very violently toward the left’. They attempted to recover with full right rudder ‘as far as it would go, but by that time it was too far gone’ (Figure 1).
Witnesses reported observing the aircraft, about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted. The nose then dropped, and the aircraft impacted terrain in a steep inverted attitude. The witnesses described what they saw as similar to a spin entry to the left.
Figure 1: Flight track, with the approach to land phase highlighted in yellow
Source: Google Earth, annotated by ATSB using VH-YVF flight data
ATC also observed the accident and initiated an emergency response. The student pilot was severely injured, and the aircraft was substantially damaged. There was no post-impact fire.
Context
Pilot information
The student pilot commenced flying training with Soar Aviation in March 2019 and gained a Recreational Aviation Australia (RAAus)[4] Pilot Certificate on 30 September 2019. The student pilot then converted their pilot certificate to a Civil Aviation Safety Authority (CASA) Recreational Pilot Licence (RPL), which was issued on 13 November 2019.
Operation of VH‑registered aircraft such as VH-YVF (YVF) required a minimum of an RPL. In order to exercise the privileges of the RPL, the student pilot was first required to complete an aircraft flight review. At the time of the occurrence, this had not been completed. In addition, the student pilot did not hold an RAAus endorsement for ‘in-flight adjustable propeller’, nor the CASA-equivalent ‘manual propeller pitch control’ as fitted to the Bristell (see the section below titled Aircraft information).
The student pilot had accrued about 72 hours flight experience, which included 10 hours of solo flight, all in the RAAus-registered Aeropakt A-32 Vixxen (refer to the Aircraft information section). The student pilot’s last recorded solo flight was on 21 October 2019.
The student pilot underwent their baseline CASA medical examination in March 2019 and at the time of the accident held a current Class 1 medical certificate, with nil restrictions or conditions.
Aircraft information
BRM Aero Bristell
The BRM Aero Bristell S-LSA is a two-seat, all-metal, low-wing aircraft, with fixed tricycle landing gear, steerable nose wheel and stick control. YVF, serial number 330, was powered by a Rotax 912 ULS horizontally opposed four-cylinder normally aspirated engine and a variable pitch MT-Propeller. The aircraft was manufactured in the Czech Republic in 2018 and registered in Australia the same year.
YVF was flown for 2.3 hours on the day before the accident, with no reports of any issues, and had a total time of 997.8 hours. A review of the maintenance logbooks did not identify any prior accidents or major repairs.
Figure 2: VH-YVF
Source: Used with permission
The aircraft manufacturer’s Aircraft Operation Instructions manual had the following guidance on headwind and crosswind limitations (Figure 3).
Figure 3: Bristell wind limitations
Source: Soar Aviation
With regard to the different crosswind limitations, the manual did not define the terms ‘average’ or ‘skilled’ pilots.
Aerokprakt A-32 Vixxen
The Aeroprakt A-32 Vixxen (Vixxen) aircraft is a Ukranian-built two‑seat, high-wing, tricycle gear ultralight. The Vixxen is powered by a Rotax 912ULS engine and a 3-blade KievProp ground‑adjustable propeller.[5] In addition, the Vixxen is configured with an all‑flying horizontal ‘stabilator’[] and conventional flight control yoke.
Figure 4: Typical A-32 Vixxen
Source: Ian McDonell
Differences in handling between the Bristell and the Vixxen
When asked about the differences between the Bristell and the Vixxen, in general handling and stall characteristics, flight instructors advised that:
it would typically take three to four flights to get used to the new type, particularly yoke versus stick
the Bristell’s elevator was significantly smaller and therefore less sensitive
significant forward movement of the Bristell’s flight control stick is required with the in‑flight application of power to counter a pitch‑up tendency
in a stall, the Bristell ‘really did like to drop a wing’, usually the left, and ‘if it does so, it is not normally as gentle as other planes that I’ve flown …, if I was to compare it to the Vixxen, I would say you’d want to be much more aware of what you’re doing in the Bristell’.
Site and wreckage examination
Examination of the wreckage (Figure 5) did not identify any evidence of pre-existing faults or engine issues which may have contributed to the loss of control.
The site and wreckage examination identified that YVF impacted terrain in a nose-down, inverted attitude. In addition, damage to the airframe and engine was indicative of the aircraft being in a moderate spin/yaw to the left, at the point of impact. This was consistent with witness reports that the aircraft pitched up, rolled to the left and impacted the terrain inverted, in what appeared to be the commencement of a spin.
Figure 5: Accident site
Source: ATSB
Recorded flight data
The aircraft was fitted with a Garmin G3X avionics system, which was an integrated flight instrumentation, position, navigation and communication system. The G3X unit had a flight data logging feature which automatically stored flight and engine data to its memory module.
The ATSB was able to download the data from the occurrence flight however, the data stopped just as the aircraft flew over the runway 17 threshold (Figure 6). It is likely the final seconds of data were lost due to the interruption of electrical power to the unit at impact. The last 5 seconds of recorded data captured:
indicated airspeed reducing from 60 to 51 kt
altitude decreasing from 106 ft to 76 ft
vertical speed stable at -255 fpm
roll no more than 5° either side of wings level
pitch increasing from about -0.5 to +5.0° but not stable
yaw varying from 0 to -5°/s
wind speed and direction: stable at 223° and 15 kt (13 kt crosswind)
engine RPM decreasing from 3,730 to 2,580 and fuel flow relatively stable at 2.2‑2.4 gallons/hr
GPS track was aligned with the runway centreline.
Figure 6: Accident site overview
Source: Google Earth and ATSB, annotated by ATSB
Weather
The Bureau of Meteorology (BoM) automatic weather station at Moorabbin Airport recorded observations at one-minute intervals (Table 1), with the loss of control occurring at about 0955. The temperature was steady, at about 15°C, at the time of the occurrence.
Table 1: Moorabbin Airport weather observations
Time
Wind (kt)
Wind direction - magnetic
Max gust (kt)
0952
13
229
15
0953
11
233
13
0954
13
232
15
0955
12
226
15
0956
12
247
14
The crosswind component at the time of the loss of control was calculated to be about 13 kt, accounting for the observed 15 kt gust. The Moorabbin automatic terminal information service was advising of a 12 kt crosswind at that time and the student pilot reported noting this during the flight.
Soar Aviation procedures
Gobel Aviation, trading as Soar Aviation (Soar), was a CASA Part 141 authorised flight training organisation. Soar provided flight training from ab-initio through to obtaining a commercial pilot licence (CPL). Soar’s training syllabus, in conjunction with the Soar Operations Manual and CASA Part 61 MOS Competencies into individual flight lesson for training and assessment, outlined the competency requirements for each phase of the flight training, including suggested lesson content and duration. Where a pilot required additional flying training to complete a competency, these flights could be added to the training schedule.
Students typically commenced training on the RAAus-registered Aeroprakt A-22 Foxbat or Vixxen aircraft, and then transitioned to the VH-registered Bristell for the command-building flights during the CPL phase. The syllabus identified 3 hours of familiarisation flight training when transitioning between aircraft types.
Solo training flight procedures
Soar Advanced Flight Training Operations Manual Part 3B Conduct of training operations detailed the procedures for ‘authorisation of training flights’. The procedures for flight preparation and planning, ‘prior to any training flight’ included pre- and post-flight briefings and that ‘the flight is authorised by an approved person’. The student pilot’s records showed that they had ‘read and understood’ the procedures. In addition, they had followed these procedures during their flight training on the Vixxen.
The procedure for solo flights stated that ‘the authorising instructor will only dispatch the flight’ when they had confirmed 13 checklist items, which included:
the student had completed all training and examinations as prescribed by the syllabus for the solo flight
the student flight training records indicate that they have achieved the required standard for all elements of competency for the flight, including flight crew licence and endorsements, as applicable
the student had been briefed on the objectives, conditions and limitations of the intended solo flight, including that task or route to be flown, number of circuits (if applicable), traffic and ATC consideration, and actions to be taken during an emergency
the student was clear on what they are authorised to do while on their solo flight
the actual and forecast weather conditions, including runway crosswind and last light limitations were suitable considering the student’s previous competence in similar conditions
the daily inspection was complete and certified
solo risk matrix has been completed and authorised by a flight instructor.
The solo risk matrix form included considerations for aircraft serviceability, pilot experience and weather. Pilot experience included a check for ‘5 hours dual training on aircraft type’. The weather section included consideration to wind (gusts and turbulence) and crosswind (Table 2), among other factors.
Table 2: Solo risk matrix crosswind and wind gusts component
Crosswind
Forecast gusts
Risk rating
>= 10 kts for Ab-initio, 14 kts for Navigation (Nav), aircraft limit for commercial pilot licence (CPL) phase
20 kt or higher
3
<=8 kt for Ab-initio, 10 kt for Nav, 14 kt for CPL phase
10 kt or higher
2
<= 5 kt for Ab-initio, 8 kt for Nav, 10 kt for CPL phase
Less than 10 kt
1
The risk rating detailed that dispatch of the flight, at level 3, was at the discretion of a Grade 1 instructor. Level 2 was at the discretion of a Grade 2 instructor and level 1 was ‘limited by the student’s personal minimums’. The solo risk matrix form was to be signed by the student and authorising instructor, prior to flight.
Soar advised the ATSB that, had a solo flight been scheduled for the student pilot, in a Vixxen, the risk assessment would likely have resulted in level 2 ‘at the discretion of a Grade 2 flight instructor’. This would factor in the pilot’s skills and experience in the Vixxen, which indicated 10‑14 kt crosswind for the equivalent skill level of the student pilot. Further, Soar advised that the instructor and the pilot would have reviewed the weather, and discussed operational aspects, prior to the flight being approved.
Flight booking system
Soar required students to book flights in advance, by liaising with operations staff, to ensure their flight training was progressing at an acceptable rate. An aircraft, and an instructor where applicable, were assigned to the booking however, the exact nature of the flight was not assigned until amended by the instructor, as part of the pre-flight briefing.
Bristell flight training
In preparation for their commercial pilot licence training phase, the pilot received a 2-hour familiarisation flight in a Bristell, on 11 December 2019. Due to weather limitations, the lesson entry report noted that the following required competencies were unable to be assessed:
take off in a crosswind
land aeroplane in a crosswind
enter and recover from a stall
recover from incipient spin
perform recovery from missed landing.
The lesson entry report identified these items as competency grade 5 ‘the element has not been assessed’[6] and the instructor noted they were to be completed on a future flight.
The student pilot reported, from their recollection of the post-flight debrief with the instructor, that the aircraft flight review and endorsement for the manual pitch propeller control had been ‘signed off’. Further, they believed they were advised by the instructor as ‘you’re good to go’. From this, the student pilot believed they were instructed, and authorised, to conduct a solo flight in a Bristell.
Despite that belief, the student pilot also advised the ATSB that prior to the solo flight on 12 December 2019, they were:
feeling apprehensive, ‘after only 1 hour of training’ and still getting used to the different controls and trim mechanism
aware that they hadn’t received any crosswind or stall training
only going to conduct circuits, instead of navigation practice, as they didn’t feel comfortable flying the Bristell and wanted ‘to get used it more’.
The flight instructor’s recollection from the 11 December 2019 Bristell dual training flight included:
describing the critical differences between the Vixxen and the Bristell
the student pilot ‘tended to pitch the aircraft more than necessary’ and the importance of avoiding this was ‘stressed a number of times in the circuit’
the student pilot ‘tended to allow the speed to drift down’ during landing
landings were fine but on the touch and go, with full power, tended to pitch up too soon
the requirement to remind the student not to handle the Bristell like the Vixxen
their belief that the student pilot ‘definitely was not ready for a solo on that aircraft’.
The instructor reported that they didn’t specifically say the student pilot ‘was not cleared for solo’ flight but ‘they don’t normally do that, it is clear from the debrief’’. In addition, the student pilot was advised of the requirement for stall training on their next flight. Finally, the lesson entry report had been endorsed by the both the instructor and the student, indicative of them having received and understood the post-flight briefing.
Following this accident, a number of procedural changes relating to the conduct of solo flights were implemented (see the section titled Safety action).
ATSB observation
On 19 February 2020, CASA issued Safety Notice 01-2020to pilots and operators of Bristell Light Sport Aircraft. CASA also updated this notice on 28 July 2020.
This Safety Notice included operational limitations in relation to particular activities associated with any flying training operation performed by BRM Aero Ltd, NG4 and NG5 Light Sport Aircraft operating with a Special Certificate of Airworthiness.
This included that these aircraft were:
…prohibited from conducting an intentional stall of the aircraft, or from performing any flight training activities that could reasonably lead to an unintended stall…
Go-around
Whenever landing conditions are not satisfactory, a go-around should be initiated. A go‑around is considered a normal procedure and, although it is not often required, with appropriate training, planning and preparation it should not result in increased risk.
The Federal Aviation Administration publication, The Airplane Flying Handbook, Chapter 8 (pages 12 and 13) provides the following guidance for go-arounds:
Although the need to discontinue a landing may arise at any point in the landing process, the most critical go-around is one started when very close to the ground. The earlier a condition that warrants a go-around is recognized, the safer the go-around/rejected landing is. The go-around maneuver is not inherently dangerous in itself. It becomes dangerous only when delayed unduly or executed improperly…
… Attitude is always critical when close to the ground, and when power is added, a deliberate effort on the part of the pilot is required to keep the nose from pitching up prematurely. The airplane executing a go-around must be maintained in an attitude that permits a buildup of airspeed well beyond the stall point before any effort is made to gain altitude or to execute a turn. Raising the nose too early could result in a stall from which the airplane could not be recovered if the go-around is performed at a low altitude.
The Civil Aviation Safety Authority Flight Instructor Manual (p47) provides the following guidance for instructor on go-arounds:
The following points must be emphasised [by the instructor]:
(iv) That large changes of trim may be experienced during this procedure.
Safety analysis
On the morning of 12 December 2019, a student pilot took off from Moorabbin Airport, Victoria, intending to conduct a series of circuits in a BRM Aero Bristell, registered VH-YVF. After passing the runway threshold during the first approach for a touch and go landing, the student pilot lost control of the aircraft and collided with terrain, on a grassed area alongside the runway.
The analysis discusses the student pilot’s preparation for the flight in the context of the flight school’s requirements, as well as the contributing factors that led to the loss of control and collision with terrain.
Solo flight dispatch procedure
Following completion of an instructional familiarisation flight in the Bristell the day before the accident flight, the student pilot incorrectly believed that they were ‘authorised’ to conduct a solo flight in the aircraft. The flight instructor who conducted the familiarisation flight acknowledged that, while they ‘didn’t specifically say that [the student pilot] was not cleared for solo’, it should have been evident as the student had not conducted any crosswind or stall training in the Bristell. Additionally, the post‑flight briefing, signed by the student, detailed that these required sequences were to be conducted on the next flight.
Further, the student pilot continued with the solo flight, despite reporting they were ‘not comfortable operating’ the new aircraft type. They also advised their belief that, as they were in the ‘command building’ phase of their training, the solo flight procedures were not required. There was no statement to that effect in the Operations Manual. In addition, there was no evidence the student pilot sought to clarify whether or not they were authorised and/or if the solo procedures were required.
Had the solo flight approval procedures been followed, they would have identified that the student pilot had not yet achieved the competencies required for solo flight in the Bristell. More generally, following these procedures would have identified the hazard associated with the crosswind conditions and allowed an assessment of the risk for pilots with limited experience on the aircraft type.
Aircraft handling
The student pilot had undertaken only one supervised training flight in the Bristell aircraft, which did not include any go-arounds, crosswind landings or stall training. Therefore, the student pilot’s familiarity with the aircraft type was very limited.
The Bristell exhibits different handling characteristics to the other aircraft type the student pilot had previously operated. Specifically, instructors reported that it is less docile and has a stronger tendency to pitch up when engine power is applied for a go-around. The instructors also reported that the Bristell has less elevator authority to counter the nose-up effect and a greater tendency to drop a wing (usually the left) during a stall.
During the flare prior to touching down, the student pilot detected the aircraft drifting left of centreline, most likely due to the prevailing crosswind, and elected to commence a go-around. After initiating the go-around, they felt the aircraft forcefully pitch up, a behaviour consistent with instructor’s description. Being unfamiliar with the aircraft type, the student pilot was not adequately prepared for this pitch up tendency and did not anticipate or respond effectively to prevent the aircraft stalling.
Once the aircraft stalled, it entered an incipient left spin. Recognising that recovery from the stall at such a low height may not have been possible, as the student pilot was unfamiliar with the aircraft’s stall behaviour, their capability to prevent further rotation or recover the aircraft prior to the collision with terrain was also very limited.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving BRM Aero Bristell, VH-YVF on 12 December 2019.
Contributing factors
The student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.
The required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.
During the conduct of a go‑around at low level following deviation from the runway centreline, the aircraft aerodynamically stalled and commenced a spin.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Safety action by Soar Aviation
Soar Aviation advised the ATSB that they had implemented revised procedures to ensure an aircraft could not be taken by a student for a solo flight, either deliberately or inadvertently. Aircraft keys were now secured and could only be accessed by an instructor once the procedures had been followed and solo flight was authorised.
Further, the booking system was changed so that operations ‘reserve’ an aircraft for a student and allocated an instructor, with the instructor required to change the reserve booking to the authorised ‘flight lesson’.
Soar Aviation ceased flight training operations on 29 December 2020.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Soar Aviation
the student pilot
Civil Aviation Safety Authority
BRM Aero
witnesses
Airservices Australia
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Soar Aviation
the student pilot
Civil Aviation Safety Authority
BRM Aero
Air Accidents Investigation Institute of the Czech Republic.
Submissions were received from:
Soar Aviation
the student pilot
Civil Aviation Safety Authority.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 4 July 2019, while conducting a demonstration flight of an Alauda Airspeeder prototype unmanned aircraft system at Goodwood Aerodrome, United Kingdom (UK), the remote pilot lost control of the aircraft. In response, the pilot activated the safety ‘kill switch’ intended to immediately terminate the flight, but it had no effect.
The unmanned aircraft then climbed, to approximately 8,000 ft and entered controlled airspace at a holding point for flights arriving at Gatwick Airport, before its battery depleted and it fell to the ground. It collided with terrain in a field of crops approximately 40 m from occupied houses, outside of its designated operating area. There were no injuries.
Investigation
The UK Air Accident Investigation Branch (AAIB) investigated this occurrence. As Australia was the State of Manufacture of the aircraft, the AAIB requested appointment of an Accredited Representative from the ATSB.
To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act2003.
Conclusion
The AAIB found that the Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and that its design and build quality were poor. In addition, the operator’s operating safety case, which formed the basis for gaining an exemption from the UK Civil Aviation Authority, contained several statements that were shown to be incorrect.
The Civil Aviation Authority’s Unmanned Aircraft Systems unit had assessed the operator’s application and, after clarification and amendment of some aspects, issued an exemption to the Air Navigation Order to allow flights in accordance with the operators Operational Safety Case. The Civil Aviation Authority did not meet the operator or inspect the Alauda Airspeeder Mk II before the accident flight.
There have been many other similar events where control of an unmanned aircraft has been lost, resulting in either it falling to the ground or flying away. The AAIB also identified that, even a small unmanned aircraft falling from a few metres could cause a fatal injury if it struck a person.
The AAIB investigation report made several Safety Recommendations and the final investigation report can be found at www.aaib.gov.uk.
Any further information regarding this investigation should be directed to the AAIB via: enquiries@aaib.gov.uk
_____________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIB investigation of the occurrence.
Occurrence summary
Investigation number
AE-2019-032
Occurrence date
04/07/2019
Location
near Goodwood Aerodrome, West Sussex, United Kingdom
State
International
Report release date
24/02/2021
Report status
Final
Investigation level
Short
Investigation type
External Investigation
Investigation phase
Final report: Dissemination
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Loss of control
Occurrence class
Accident
Highest injury level
None
Aircraft details
Model
Alauda Airspeeder prototype unmanned aircraft system (UAS)
On 28 May 2019, a Cessna 152, registered VH-JIW, was being operated by Basair Aviation College on a training flight from Archerfield Airport, Queensland. On board was a student pilot on their first flight, and a flight instructor.
During the training flight, the instructor was demonstrating the use of trim, with the student flying the aircraft. At about 2,000 ft above ground level, the aircraft abruptly pitched down and entered into a dive. The instructor took control of the aircraft and recovered from the descent at about 400 ft, about 25 seconds after the dive commenced. Subsequently the flight instructor elected to terminate the lesson and returned the aircraft to Archerfield Airport.
The instructor sustained minor injuries and the student was uninjured. An examination of the aircraft identified significant structural damage to the right horizontal stabiliser, which was indicative of in-flight overload during dive recovery. In addition, the instructor inadvertently bent the throttle control in the cockpit, which made movement of the control stiff but still operable.
What the ATSB found
The ATSB found that the student released the control wheel leading to the aircraft entering into a steep dive. The flight instructor had applied a large amount of nose-down trim during the course of instructing the lesson, resulting in a strong nose-down tendency of the aircraft when the controls were released. The flying school’s instructor guide did not specify a limit of trim input for such exercises.
It was also determined that the instructor’s hands were not in a ready position to take control in the event of any mishandling by the student pilot. The recovery by the instructor was likely further delayed after sustaining a head injury during the in-flight upset, and initially being unsure about what had happened and how to then recover the aircraft.
What has been done as a result
The operator has revised its training procedures for use of trim to include detailed instructor demonstrations prior to the student practicing manoeuvres. This ensures the student understands the required use of trim and the effect it has on the aircraft flight characteristics to maintain flight attitudes. The operator has also revised its training procedures to use a consistent moderate amount of trim.
Safety message
The first stages of flight training can be an exciting yet daunting period for a student. Any uncertainty should be raised with the instructor before taking action in case it leads to an unsafe situation. Conversely, instructors need to account for the potential for the student to carry out unexpected actions. This means that lessons should be conducted under the lowest risk conditions that still impart the lesson intent.
The investigation
The occurrence
On 28 May 2019, at about 1110 Eastern Standard Time,[1] a Cessna 152 aircraft, registered VH‑JIW and operated by Basair Aviation College, departed Archerfield Airport, Queensland, for a training flight. On board was a student pilot on their first flight, and a flight instructor.
During the flight, the instructor demonstrated a number of manoeuvres from the ‘effects of control’ flight-training syllabus. As part of this, the instructor placed the aircraft out of trim with the pitch trim wheel,[2] while the student was maintaining straight and level flight.
With the aircraft in a nose-up trim, the student then practiced re-trimming the aircraft for level flight while maintaining attitude using nose-down pressure on the control wheel. As the aircraft was approaching overhead Lagoon Island at about 2,000 ft above ground level, with the student flying, the instructor moved the pitch trim to about two-thirds travel nose down. The student maintained attitude with nose-up pressure on the control wheel. The instructor’s feet were lightly on the rudder pedals, left hand on their leg, and right hand resting on the glareshield (next to the control wheel).
The student maintained straight and level flight for a short period. When the procedure was to return the elevator trim to neutral, the student became confused about the correct procedure and let go of the control wheel. The aircraft rapidly pitched nose-down, rolled left, and entered into a dive. During these events, the flight instructor’s headset dislodged from their head.
The flight instructor took control of the aircraft and subsequently arrested the descent at about 400 ft, about 25 seconds after the descent commenced. The available radar data (Figure 1) showed that from when the dive commenced, to when the instructor regained control, the aircraft had an average rate of descent of over 3,000 ft/minute, with the rate being higher in the initial part of the descent.
Figure 1: VH-JIW’s flight path, dive and recovery as derived from radar data
Source: Google Earth, modified by the ATSB
During the occurrence sequence, the instructor pulled the throttle back quite rapidly and, at some stage during the initial stages of the sequence, the throttle was bent. The throttle then became stiff, however was still able to be moved. The instructor recalled applying right rudder during the recovery but did not fully recollect if that was to recover from a left spiral dive or spin. The instructor stated they did not re-trim the elevator system to a neutral position until after recovery from the dive.
When they had recovered from the dive, the aircraft was on a reciprocal heading. The instructor carried out a flight control function check and confirmed the aircraft was controllable. The instructor then terminated the lesson and advised air traffic control that their aircraft had descended 1,500 ft ‘quite suddenly’ and they were returning to Archerfield Airport. The aircraft landed without further incident at about 1139.
During the occurrence, the instructor sustained several minor injuries, including an injury to their left shin after it contacted the underside of the instrument panel, a head injury from impact with the cabin roof, and bruising to the right hip. The student pilot was uninjured. The aircraft sustained damage to the right horizontal stabiliser.
Context
Personnel information
The instructor pilot held a grade 3 instructor rating and had about 320 total flight hours, including 100 hours in Cessna 152 aircraft. They had instructed this lesson about seven times before this occurrence.
The student pilot was conducting their first flight.
Pitch trim system
The pitch trim system on VH-JIW consisted of a manual trim wheel located on the lower instrument panel, which controlled a full-span trim tab on the right elevator only.
Placing the aircraft in an out-of-trim condition places a load on the flight control surfaces that results in the aircraft changing attitude accordingly, if the pilot does not oppose the condition. The flight controls will have a ‘heavy’ feel to them when held against the trimmed attitude. This force is neutralised when the aircraft is either re-trimmed or allowed to adopt the trimmed attitude.
Aircraft damage
A post-flight inspection of the aircraft found that the right horizontal stabiliser was bent and twisted during the occurrence, resulting in creasing on the upper and lower skin sections (Figure 2). The left horizontal stabiliser had no significant damage.
Figure 2: Right stabiliser damage
Source: Operator, annotated by the ATSB
The deformation of the right stabiliser resulted in a number of rivets on the aft lower surface pulling through the skin. The internal structure was cracked and creased (Figure). There was no evidence of damage to attachment points of the stabiliser assembly.
Figure 3: Leading edge removed showing cracking to internal structure
Source: ATSB and Cessna, annotated by the ATSB
An ATSB examination of the right horizontal stabiliser did not identify evidence of pre-existing damage to the structure.
In addition to the bent throttle control, the aircraft compass had detached from its mount on the windscreen.
Meteorological information
The aerodrome forecast (TAF) for Archerfield Airport issued at 0907 on 28 April stated that conditions would be CAVOK (cloud and visibility ok and no significant weather phenomena). The forecast wind was 260° at 10 kt. Recorded weather conditions at 1130 were consistent with the forecast. The area forecast also did not show any adverse weather conditions, such as turbulence, that may have contributed to the aircraft experiencing a rapid change of direction or altitude.
Flight instructor guidance
The flight training school’s instructor guide outlined the procedure for teaching the use of the trim component of the effects of controls lesson. This procedure was in accordance with the guidance provided by the Civil Aviation Safety Authority in Appendix D of Civil Aviation Advisory Publication (CAAP) 5.14-2 (Flight instructor training (Aeroplane)).
The guidance stated that, with the student flying straight and level, the instructor would place the aircraft out of trim. The student then re-trimmed the aircraft to relieve the load on the controls. This was then repeated in the opposite direction of trim travel.
The CASA CAAP referred to the Federal Aviation Administration (FAA) Aviation Instructor’s Handbook, which stated:
Flight instructors should always guard the controls and be prepared to take control of the aircraft.
Safety analysis
Use of trim
When the student released the controls without re-trimming the aircraft, the aircraft entered a sudden dive. Since the flying school operator’s instructor guide did not include a limit to the amount of trim used during the ‘effects of control’ lesson, flight instructors could set the trim to differing amounts. On the occurrence flight, it had been set at about two-thirds nose-down travel. This amount meant that the aircraft’s nose-down response was more abrupt and stronger than needed to convey the intent of the lesson.
Instructor hand position
During the exercise, the instructor’s right hand was resting on the glareshield; this was not an optimal position to guard the controls and to be ready to react to any adverse student inputs. This, coupled with the suddenness of the movement and the instructor’s injuries, and being unsure as to the cause of the dive and best recovery technique, likely led to a delay in taking control of the aircraft and its subsequent recovery.
Dive recovery
The instructor attempted to regain control of the aircraft before placing the elevator trim into a neutral position, leading to the aerodynamic force being concentrated on the right horizontal stabiliser (where the trim tab was located) rather than spread across both stabilisers during the dive recovery.
These asymmetric flight loads, induced by the elevator trim imparting additional load on the right side, twisted the stabiliser at the forward outboard tip, about 30 mm downwards relative to its original position. This likely resulted in the right stabiliser being close to total failure. The large amount of nose-down trim at the time of the upset also increased the effort and effect required to recover from the dive.
Findings
From the evidence available, the following findings are made with respect to the loss of control of Cessna 152, registered VH-JIW, which occurred near Archerfield Airport, Queensland on 28 May 2019.
Contributing factors
In the course of the student pilot’s first training flight, during a lesson in the effects of control, the student released control wheel backpressure suddenly.
The instructor’s use of a large amount of nose-down elevator trim for the lesson increased the effect when the student released backpressure on the elevator, leading to a sudden nose-down pitch change and subsequent entry into a dive.
The instructor was not prepared for the sudden nose-down pitch change, leading to a delay in the recovery from the dive.
Other factors that increased risk
During the recovery from the dive, the horizontal stabiliser experienced excessive asymmetric flight loads, resulting in bending and buckling of the right horizontal stabiliser structure.
Safety action
The operator proactively revised its instructor guide for the use of trim. The new procedure introduced placing the aircraft into a cruise climb and explaining how the use of trim can reduce the control load. This ensured the student understood the required use of trim and the effect it had on the aircraft flight characteristics to maintain flight attitudes.
The revised instructor guide also included detailed instructor demonstrations prior to the student practicing the manoeuvre. The new procedure was taught with the aircraft in a nose-up condition only and ensured that all instructors were using the same trim input to maintain the best rate of climb.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight instructor
the student pilot
Basair Aviation College
Civil Aviation Safety Authority.
Submissions were received from:
the flight instructor
Basair Aviation College.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 14 April 2019, the pilot of a Pilatus PC-12/47E aircraft, registered VH-OWJ and operated by Royal Flying Doctor Service - Western Operations (RFDS), was conducting a medical transport flight under instrument flight rules from Merredin to Jandakot within Western Australia. A RFDS aeromedical crew consisting of a flight nurse and doctor were on board with a non-critical patient who was being transferred to a hospital in Perth. For the midnight departure, there were almost clear skies with minimal ambient and celestial lighting.
About 1.5 minutes after take-off, ‘Pitch Trim Runaway’ warnings activated and the pitch trim continued to move nose-down without any pilot or autopilot inputs. The pilot initiated the applicable emergency procedure but inadvertently selected the Flap Interrupt switch rather than the Trim Interrupt switch. Consequently (before the next checklist item was actioned), the pitch trim continued to runaway until it reached full nose-down with associated serious control difficulties.
The pilot did not identify the mis-selection and continued to address the emergency procedure without resolving the full out-of-trim condition. With the assistance of the doctor seated in row 2, the pilot managed to return to Merredin for a flapless landing. The aircraft was undamaged and the occupants uninjured.
What the ATSB found
The ATSB found that the pitch trim runaway occurred because of a malfunctioning relay in the manual (main pilot-engaged) stabiliser trim system.
As the (uninterrupted) pitch trim runaway progressed, the reinforcing cycle of increasing control loads, forced descent, and increasing airspeed was initially exacerbated by high engine torque. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
After the pilot addressed items 2 and 3 of the emergency procedure, the malfunction was neutralised and the alternate stabiliser trim system was available to adjust the trim. However, the pilot did not identify those positive conditions and continued with items 4 to 8 of the procedure, which disabled the alternate stabiliser trim system, prevented pitch trim adjustment and prolonged the serious control difficulties.
The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches, unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
The ATSB found that the emergency procedures and systems information in the PC-12 Pilot Operating Handbook/Airplane Flight Manual and Quick Reference Handbook did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this incident, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.
As a factor that increased risk, the effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems knowledge and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).
What's been done as a result
Pilatus advised that a design change, to reduce the likelihood of a trim runaway, was developed before the occurrence to replace the mechanical pitch trim relays with solid-state relays but was not fully implemented due to limited parts availability. Both applicable service bulletins have now been published.
Pilatus also advised that the probability of erroneous activation of the Flap Interrupt switch instead of the Trim Interrupt switch has been reduced by the publication and active distribution of a Safety Information Letter (SIL-003) to all customers, operators and service centres. This includes a reminder of procedures when encountering a trim runaway condition.
The ATSB acknowledge these positive safety actions but notes that the Trim interrupt and Flap Interrupt switches on the PC-12 do remain identical and co-located, and there is potential for engineering controls to eliminate the mis-selection of the interrupt switches.
RFDS investigated the occurrence and implemented safety action such as increasing pilot awareness about the pitch trim systems and enhancements to their related training and checking processes.
Safety message
The ATSB advises operators of PC-12 aircraft to review their training/checking processes related to the pitch trim system to ensure that pilots are adequately prepared to manage a runaway emergency. More generally, operators and pilots are advised to enhance awareness of expected system behaviour from switch and other control selections.
For flight control emergencies such as out-of-trim conditions, there is an imperative to maintain control while resolving the technical problem. A critical factor for pilots to consider is control of airspeed and associated engine power.
Operators are encouraged to submit reports of PC-12 pitch trim defects to the Defect Reporting Service to facilitate the Civil Aviation Safety Authority’s monitoring of continuing airworthiness data.
The occurrence
Background
On 13 April 2019, a pilot employed by Royal Flying Doctor Service - Western Operations (RFDS) based at Kalgoorlie, Western Australia was rostered for a night standby duty between 1800 and 0600 Western Standard Time (WST). Soon after starting duty, the pilot and rostered medical crew was tasked to transfer a patient from Kalgoorlie and a patient from Albany to Jandakot within Western Australia. After consideration of the weather forecasts and medical status of the respective patients, the decision was made to proceed direct to Jandakot then conduct a flight to Albany and return, followed by a positioning flight to Kalgoorlie.
For this series of flights, the pilot was operating a Pilatus Aircraft Ltd. PC-12/47E aircraft, registered VH-OWJ, as a medical transport flight in the aerial work category under the instrument flight rules. At 2032, the pilot departed Kalgoorlie with a patient, flight nurse and doctor on board.
During the flight to Jandakot, the RFDS operations centre advised the pilot and medical crew of a patient at Merredin that required transfer to Jandakot as a higher medical priority than the Albany patient. For on-board patient care reasons, the flight continued as planned to Jandakot, landing at 2213. The pilot and medical crew were then re-tasked to conduct a flight to Merredin for the previously advised patient transfer.
The pilot departed Jandakot at 2253 and landed at Merredin aeroplane landing area (ALA) at 2341. This flight was described as normal except for diversions around storm cells that added 15 minutes to the planned flight time. The weather observed at Merredin was almost clear skies with a few scattered clouds to the south of the aerodrome and light winds.
Just after midnight, the pilot taxied the aircraft for runway 28 at Merredin ALA with the patient, flight nurse, and doctor on board. The pilot was seated in the front left control seat and the doctor was seated in the second row on the right, facing backwards.
The pilot conducted a normal take-off and was airborne at 0008:34. For the departure, the pilot was manually flying with the intention to engage the autopilot when the aircraft was established in the climb. As was typical for the phase of flight, the pilot was intermittently engaging the trim switches on the control wheel to make pitch trim adjustments. There was minimal ambient and celestial lighting for the departure.
Emergency condition and initial pilot response
At 0010:05 (about 1.5 minutes after becoming airborne), as the aircraft was on climb through 2,700 ft AMSL (1,400 ft above ground level)[1] at a (calibrated) airspeed[2] of 140 kt, the following occurred without any apparent precursors:
master warning light illumination
‘pitch trim runaway’ voice annunciation
‘pitch trim runaway’ warning message in red on the multi-function display
continued pitch trim movement in a nose down direction without pilot or autopilot input at the time (uncommanded).
The pilot recalled hearing and seeing those warnings and that the aircraft pitched nose-down violently shortly afterwards. With both hands pulling on the control column to raise the nose, the pilot found that the force required to move the control column was extremely high and required maximum effort. The pilot was unable to counteract the nose-down force and the aircraft developed a high rate of descent at approximately 2,000 ft/min.
In response to the warnings, the pilot initiated the Pitch Trim Runaway emergency procedure from memory. The pilot recalled that:
The first action was to select the Trim Interrupt switch on the centre console from NORM (normal) to INTR (interrupt). At the time, the pilot believed that this was carried out and that it was difficult to reach because of the high control column loads. (A ‘Flaps Caution’ was recorded at 0010:11, 6 seconds after the initial trim warning. This caution is consistent with operation of the Flap Interrupt switch instead of the Trim Interrupt and was not noticed by the pilot at the time.)
After a short interval to focus on raising the nose, the pilot pulled the Pitch Trim circuit breaker on the essential bus to the OPEN position. (An Autopilot Fail Advisory was recorded at 0010:39, 34 seconds after the initial trim warning. This was coincident with cancellation of Pitch Trim Runaway warning and consistent with opening of circuit breaker)
The Trim Interrupt switch was selected back to NORM. (Based on the first action, this was probably the Flap Interrupt switch.)
Following those actions, the pilot was concerned that there was no change to the condition of the aircraft. This was contrary to the pilot’s expectations from training, which was that the Trim Interrupt switch should have stopped the dive and the opened circuit breaker should have relieved the situation. (Either or both actions would stop the manual trim motor from further operation but would not relieve the control loads existing at the time this action was taken.)
According to the recorded data, the pitch trim continued to operate in the runaway condition until it reached full nose down position 16 seconds after the warnings were issued. During that 16‑second period, the following data was recorded (see the indicative flight data plot in Figure 1):
engine torque remained at the take-off and initial climb setting of 42 lb (black trace)
pitch attitude went from +9.5 degrees (nose-up) down to -7.5 degrees (purple trace)
airspeed increased from 135 kt to 182 kt (red trace)
altitude initially continued to climb until 3,000 ft then reduced to 2,600 ft (green trace).
Over the next 6 seconds, the situation continued to deteriorate until the pilot reduced engine torque. At about that point, the airspeed had reached 210 kt and the altitude was down to 2,400 ft. The pilot recalled that the control forces eased somewhat following reduction of engine torque.
During the next 2 minutes, the pilot managed initially to raise the pitch attitude to 12 degrees, arrest the descent at 2,000 ft and climb to 2,700 ft, while reducing the airspeed to 125 kt. However, this was momentary as the pitch attitude cycled down to -3 degrees then back to 12 degrees with corresponding descent/climb and airspeed increase/decrease.
Figure 1: Indicative data plot showing key aircraft parameters before, during, and in the 2 minutes after the active phase (yellow band) of the pitch trim runaway.
Parameter scales not shown but are available in Figure 3.
Source: ATSB
Continuation of emergency condition and return to Merredin
By the end of that 2-minute sequence, the pilot was making a slow left turn to return to Merredin ALA and the master caution and pitch trim runaway warning activated for a short period (coincident with cancellation of the autopilot fail advisory). It is not clear from the pilot’s recollection why that occurred but it is consistent with the closing and reopening the pitch trim circuit breaker.
The pilot continued to experience severe control difficulties with another sequence of pitch attitude down to -7.5 degrees and back up to 8 degrees. The aircraft descended to a minimum altitude of 1,700 ft (400 ft above ground level) and reached a maximum airspeed of 180 kt (Figure 3).
After this sequence, the pilot decided that it was not possible to overpower the elevator force alone and requested the assistance of the doctor seated in the adjacent row. The doctor turned in the seat, reached into the cockpit, and pulled on the right control column. This had a positive effect on the variation of pitch attitude and associated airspeed and altitude parameters, although full control was not established.
At this point, the pilot continued with the Pitch Trim Runaway procedure from memory and sought to select the Trim Interrupt switch to INTR again and pulled the Alternate Trim circuit breaker. The pilot then pushed the Alternate Stab Trim switch intermittently, which appeared to have no effect in relieving elevator pressure. (At about this time the master caution and pitch trim runaway warning activated again for a short period, coincident with cancellation of the autopilot fail advisory and consistent with the closing then reopening the Pitch Trim circuit breaker).
As the aircraft was now in the Merredin circuit area, the pilot’s attention was on preparation for landing. When the flaps were selected to 15 degrees, the pilot noticed the ‘Flap’ caution on the crew alerting system (CAS) and realised the flaps were not available.
On the downwind circuit leg for runway 28, the pilot extended the landing gear. This was followed by a rapid descent from 2,150 ft to 1,650 ft (350 ft AGL) with a ground proximity warning system (GPWS) alert (Figure 2). In response, the pilot (with the doctor’s continuing assistance) pulled on the control column to raise the nose, and increased engine torque. Altitude was recovered to a maximum of 2,200 ft.
The pilot turned onto the base circuit leg and allowed the aircraft to descend. As the pilot turned onto the final approach, the aircraft overshot the runway centreline and required adjustment. On short final, the aircraft was high and the pilot was coordinating with the doctor to adjust the pitch attitude for landing. At one point, the pitch attitude was too high and activated the aural stall warning.
At about 30 ft above the runway, the pilot asked the doctor to let go of the control column and reduced engine torque to idle. The aircraft touched down firmly at 0017:15 and the pilot applied full reverse thrust and normal braking to bring the aircraft to a stop about 200 m from the end of the runway. The pilot taxied the aircraft to the parking area and shut down.
The RFDS operations centre dispatched an aircraft to Merredin to transfer the patient and RFDS personnel to Jandakot.
Figure 2: Aircraft track and vertical profile
Source: Google earth, annotated by ATSB
Post-occurrence examination and rectification
RFDS maintenance engineers travelled to Merredin to inspect the aircraft, download data, and remove the lightweight data recorder (LDR) for the ATSB. The engineers reported that the:
pitch trim was in the full nose-down position (leading edge of adjustable stabiliser fully up)
Trim Interrupt switch was selected to NORM
Flap Interrupt switch was selected to NORM
Pitch Trim circuit breaker was closed (pushed in)
Pitch Trim Alternate circuit breaker was open (pulled out)
other switches and circuit breakers were in normal positions.
The engineers secured a copy of the aircraft condition monitoring system (ACMS) and fault history database (FHDB) files for analysis by system technical specialists and provision to the ATSB. The LDR was removed and dispatched to the ATSB laboratory in Canberra where cockpit voice and flight data was recovered and analysed. A flight data plot for the complete flight follows as Figure 3.
When the aircraft was powered up, the Pitch Trim Runaway warning was immediately active. When the Trim Interrupt switch was selected to INTR, it cleared the warning and stopped the trim from operating. Based on the FHDB fault codes and continuing Pitch Trim Runaway warning, the technical specialists advised that the troubleshooting focused on the relays in the left relay panel.
RFDS maintenance engineers found that the manual pitch trim DOWN relay (identification number K161E2) had malfunctioned in a mode consistent with contacts that were stuck closed rather than being open (as would be expected with the coil de-energised). This relay was replaced and applicable operational and functional tests carried out with no further defects identified. The aircraft was certified as serviceable and flown back to Jandakot Airport without incident.
The ATSB notes that based on recorded data, for the last part of the occurrence flight, both the Pitch Trim circuit breaker and Pitch Trim Alternate circuit breaker remained open. Based on correlated parameters in the recorded data, the Pitch Trim circuit breaker was then closed when the aircraft was subsequently powered up on the ground by the pilot.
From other correlated parameters in the recorded data, the Trim Interrupt switch was not selected to INTR at any time during the flight.
Figure 3: Recorded data plot for complete flight showing the key parameters and active phase (yellow band) of the pitch trim runaway with start of doctor assistance (blue line).
In the early stages of a medical transport flight, the pilot was confronted with a pitch trim runaway emergency condition. Despite pilot actions intended to stop the runaway, the runaway was not interrupted and the pilot struggled to control the aircraft for the rest of the flight. The pilot made a good decision to enlist the assistance of the doctor and managed to coordinate their inputs to land the aircraft.
The pilot was qualified to conduct the flight and had about 7 months experience of similar operations in the PC-12 type. This patient transfer from Merredin was not a high priority flight and the aircraft was serviceable for the departure. Although the pilot was on a night shift and the take-off from Merredin was just after midnight, there were no indications of fatigue.
The safety analysis following seeks to explain how the event developed and identify the important safety considerations.
Technical failure and warnings
During normal operation of the PC-12 aircraft with the autopilot off, the pilot seeks to minimise control wheel forces by intermittently selecting the engagement switch in conjunction with the up/down switch on the control wheel. These actions energise the applicable relay and power the trim motor to move the horizontal stabiliser as directed. When the pilot releases the switches, the control circuit de‑energises the applicable relay with the usual effect of opening the power circuit to the manual trim motor and stopping trim movement.
Soon after take-off from Merredin, the pitch trim system continued to operate in a nose-down direction without pilot input or autopilot commands because of a malfunctioning relay in the manual (main pilot‑engaged) stabiliser trim system. The trim system immediately detected a pitch trim runaway and triggered the applicable Crew Alerting System (CAS) warnings.
The Master Warning, ‘Trim Runaway’ callout, and the Pitch Trim Runaway message on the Multi-function Display (MFD) provided an effective alert as to the nature of the emergency and correlated with the anomalous control forces experienced by the pilot. In this fully electric trim system (no trim wheel), the other indication available to the pilot was the trim indicator on the MFD.
As was typical for aircraft such as the PC-12, the CAS warnings did not specify the malfunctioning circuit/components or the required actions. In such cases, the pilot is required to action the applicable emergency procedure to stop the runaway, identify the affected circuit, disable the affected circuit, and utilise the unaffected circuit to make any required trim adjustments.
Initial pilot response
In response to the CAS warnings, the pilot sought to carry out the first recall item of the Pitch Trim Runaway emergency procedure by selecting the Trim Interrupt switch to INTR (interrupt). The pilot managed to action this item about 6 seconds after the warnings activated. However, recorded flight data shows that the pilot inadvertently selected the Flap Interrupt switch to INTR rather than the Trim Interrupt switch and did not identify the mis-selection.
Common aviation operational practice, also advocated by RFDS, involves an ‘identify-confirm-action’ process to minimise the inadvertent selection of wrong switches and buttons. In that context, the ATSB considered the following factors that might have influenced the pilot to mis‑select the interrupt switch:
emergency flight control condition at low altitude on dark night
visibility of the Trim Interrupt switch and label
similar location and appearance of the two interrupt switches
lack of familiarity with operating the Trim Interrupt switch during training/checking.
In the situation where there is sudden onset of an emergency condition affecting control forces at low altitude on a dark night, it is natural for the pilot to feel a sense of concern and urgency. This might have been heightened by unfamiliarity with the scenario that could not be realistically simulated in the aircraft. As such, it would be expected that the pilot would be experiencing some level of stress.
As the trim runaway progressed, the pilot’s attention was primarily focussed on controlling the aircraft and counteracting the developing pitch-down forces with both hands on the control wheel. Given the pilot reported that any hand movements from the control wheel were quick, it is likely that the pilot allocated a low level of attention to identifying and confirming the appropriate interrupt switch.
During take-off and initial climb the power lever was in a forward position. In a pilot’s normal field of view, the power lever obscured the Trim Interrupt switch but not the Flap Interrupt switch. This rendered the Flap Interrupt switch as relatively more accessible and in the circumstances, at higher risk of being mis-selected. At the same time, the cockpit lighting was dimmed for the dark‑night take-off in accordance with standard practice and that unavoidably reduced the readability of the backlit switch labels.
The Trim Interrupt switch and Flap Interrupt switches were both located in the centre console and appeared to be the same type of switch with a similar function (Figure 4 bottom right). Although the switches were differentiated by being located either side of the Alternate Stab Trim switch, and the Flap Interrupt switch was located forward of the Flap Selector Handle, the similarities increased the risk of mis‑selection.
Training and checking practices were generally oriented towards touch drills and it was unlikely that the pilot was familiar with physical operation of the Trim Interrupt switch. Given the Pilatus advice that hands-on training minimises the risk of erroneously activating the Flap Interrupt switch, it is likely that a higher level of familiarity would have assisted the pilot.
The ATSB considered the contextual factors to identify those that increased risk and might have contributed to the occurrence. Although the operating environment and visibility of the trim interrupt switch increased the degree of difficulty for the pilot, those elements are generally unavoidable and were not considered to be safety factors. The risk associated with the other two factors —interrupt switch similarities and RFDS training/checking practices—is discussed in the following section.
Following inadvertent selection of the Flap Interrupt switch, there were indications that the results were contrary to the pilot’s intention—the pitch trim continued to operate and the runaway warning message remained on the CAS display. Later, the pilot also noticed the ‘Flap’ caution message in association with attempted flap extension. However, the pilot did not associate those indications with the mis-selection.
One of the reasons for this was the surprise and confusion resulting from non-alleviation of the control forces in response to the attempted trim interrupt. That was a natural response that was probably influenced by the inconsistent representation of trim interrupt effects in training/checking. The pilot experienced a high level of stress that adversely affected the pilot’s ability to carry out the next item immediately (which would have stopped the runway) and to problem-solve.
Research has confirmed common-sense understanding that situations involving acute stress, such as an out-of-control aircraft, are particularly harmful to higher order cognitive processes, such as decision-making (Dismukes, Goldsmith and Kochan, 2015). Acute stress impairs decision-making, leading to the consideration of fewer options and an increased tendency to make biased decisions. Attention becomes difficult to control, and tends to be easily distracted by alarms and other threatening signals. Anxious thoughts interfere with the resources needed to understand and resolve the emergency situation.
A potentially complicating factor in the pilot’s response was the momentary cancellation and recycling of the CAS warnings from pilot use of the manual trim switches. This characteristic was only evident because of the unsuccessful trim interrupt and was a subtle indication that manual trim was the affected circuit that had not been de-powered. The pilot was not expected to have that level of implicit systems knowledge and did not consider the possibility of switch mis-selection. In that case, the unexpected aircraft behaviour was confusing and treated as a symptom of the underlying technical problem.
As a consequence of the Trim Interrupt remaining in NORM (normal) due to the inadvertent selection of the Flap Interrupt switch, and the Pitch Trim circuit breaker initially remaining closed, power continued to be supplied through the malfunctioning relay to the manual stabiliser trim motor. The pitch trim reached the full nose down position 16 seconds after the runaway started. This created serious control difficulty for the pilot, which was exacerbated by the increasing airspeed.
Airspeed management
From the start of the pitch trim runaway, as the manual trim motor moved the horizontal stabiliser to a higher angle, the stabiliser produced progressively more lift that translated to nose-down force. The pilot was physically unable to fully counteract that force with the control wheel and the aircraft nose lowered. In the consequent descent, the airspeed increased with an associated increase in stabiliser lift and nose-down force. The pilot found this harder to counteract and the aircraft nose lowered further. This was a reinforcing cycle that reoccurred during the sequence relative to the counteracting effort applied to the controls.
In addition, when the pitch trim runaway began, the power lever was in the maximum engine torque position specified for take-off and initial climb. It remained in that position for the next 22 seconds and was a significant contributor to the initial airspeed increase. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
The Pitch Trim Runaway procedure included a note after item 7 advising pilots to reduce speed if the control forces are high. In the circumstances, the most effective means to reduce airspeed was to reduce engine torque.
The ATSB considered that the time taken by the pilot to reduce engine torque after the pitch trim runaway warning was associated with the pilot’s cognitive and physical workload as discussed in the previous section. It is likely that the pilot was prioritising aircraft control and conduct of emergency procedures, and did not perceive an immediate need to reduce engine torque. In addition, as the trim runaway developed, it became more difficult to remove a hand from the control wheel to adjust the power lever.
For flight control emergencies such as out-of-trim conditions, there is an imperative to maintain control while resolving the technical problem. A critical factor for pilots to consider is control of airspeed and associated engine power.
Continuation of emergency procedure
As control loads allowed, the pilot managed to carry out item 2 of the emergency procedure by opening the Pitch Trim circuit breaker. This de-powered the circuit with the malfunctioning relay and manual actuator motor so that the fault condition was effectively neutralised. As the trim had already run to full nose down (due to not stopping when the pilot selected the wrong interrupt switch), the only indication that this action had been successful was removal of the CAS message from the MFD.
The pilot then sought to carry out item 3 of the procedure to return the Trim Interrupt switch to NORM. It is assumed that the pilot returned the Flap Interrupt switch to NORM instead of the Trim Interrupt, consistent with earlier mis-selection of the Flap Interrupt switch. This did not have any further effect as the Trim Interrupt switch remained in NORM throughout the flight and the wing flaps remained inoperative irrespective of subsequent switch selections.
At this point, the pilot was required to make a decision according to the status of the trim runaway. With the fault condition neutralised and power available to the operable trim circuits, the pilot could have adjusted the pitch trim using the Alternate Stab Trim switch and regained full control of the aircraft. That would have been consistent with the intent of the procedure, although it was listed as item 8 in the procedure. However, the pilot did not use the alternate stab trim and decided to proceed with further items of the procedure, consistent with the condition ‘If trim runaway continues’.
The pilot opened the Pitch Trim Alternate circuit breaker as per item 5 and closed the Pitch Trim circuit breaker as per item 6. This had dual adverse effects. First, power was removed from the operative alternate trim system and second, power was restored to the malfunctioning relay and manual trim motor for a short period. (This reactivated the warnings and prompted re-opening of the Pitch Trim circuit breaker.) As a consequence of opening the Pitch Trim Alternate circuit breaker (item 5), when the pilot tried to use the Alternate Stab Trim as per item 8 of the procedure, the circuit was inoperative and this did not have any effect.
While maintaining partial control of the aircraft in difficult circumstances, the pilot managed to neutralise the malfunctioning relay in the early stages of the sequence. However, the pilot missed a critical opportunity to use the Alternate Stab Trim switch to recover control of the aircraft. By continuing the emergency procedure from item 4 onwards, the pilot disabled the operative trim system and prolonged the serious control difficulties.
The ATSB acknowledges that the serious difficulties experienced by the pilot in this phase of the emergency resulted from non-selection of the Trim Interrupt switch and consequent full nose-down pitch trim before the Pitch Trim circuit breaker was pulled. In addition to the extreme flight loads and deleterious effects of acute stress on decision-making, another consequence was absence of trim operation as an indication of runaway status. As such, when the pilot was required to assess the effect of recovery actions, the only effective indicator was activation/cancellation of the Pitch Trim Runway CAS message.
Irrespective of the ineffective actioning of item 1 of the emergency procedure, the subsequent actions required for recovery of control—items 2, 3 and 8—were unchanged. The pilot, however, did not have capability to resolve the out-of-trim condition, which relied in part on resources provided by Pilatus and training/checking provided by RFDS. These aspects are discussed in following sections.
The ATSB notes that pilot capability in this aircraft-specific context should not rely on certain levels of total aeronautical experience levels or operational experience on comparative aircraft types.
Trim Interrupt and Flap Interrupt switches
The pilot’s mis-selection of the Flap Interrupt switch in place of the Trim Interrupt switch contributed to the development of severe control forces. One of the factors identified by the ATSB was the similar location, appearance, and function of the Trim Interrupt and Flap Interrupt switches.
To manage the risk of switch mis-selection generally, RFDS training/check pilots advocated the practice of identify–confirm–action. In relation to the Trim Interrupt switch, pilots were required to identify the switch when pitch trim runaways were addressed during training/checking. RFDS pilots were also familiar with the location of both switches from the pre-flight inspection conducted on a pilot’s the first flight of the day in a particular aircraft.
Pilatus inferred there was a risk of erroneously activating the Flap Interrupt switch and that hands‑on training would reduce that risk. In the RFDS context, mis-identification of the Trim Interrupt switch was not evident during training and checking and, in the previous pitch trim runaway occurrences, the pilots had correctly identified and actioned the Trim Interrupt switch. However, the artificiality of the training/checking environment and the relatively benign conditions experienced by most pilots during the previous pitch trim runaways occurrences (daylight and phases of flight other than take-off/initial climb) were very different from conditions of this occurrence.
In the 57 pitch trim runaway events recorded by Pilatus, there were no reports of mis-selection of the Flap Interrupt instead of the Trim Interrupt switch. Although this indicates that the risk is generally not high, it may be sensitive to phase of flight and environmental conditions. There was insufficient information in the Pilatus data to make an assessment of that risk.
The risk of mis-identification could be reduced by pilots manipulating the switch during training/checking and by increased awareness of the effects of inadvertent selection of the Flap Interrupt switch. Consideration could also be given to daily pre-flight operation of the Trim Interrupt switch as implemented for Canadian PC-12 aircraft. Although these procedural controls reduce the risk, it would be preferable to implement an engineering control to remove the hazard.
The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection. While visually distinguishing close proximity switches and controls has long been shown to be an effective strategy (for example, landing gear and flap retraction levers are typically designed to resemble the lever’s function), given pilots are not required to access the Flap Interrupt switch, consideration could also be given to preventing access to it altogether.
Pilatus emergency procedure and systems information
Pilatus advised pilots in the POH/AFM that the prerequisites for safe aircraft handling in an emergency is prior knowledge of the applicable procedure and a good understanding of the aircraft systems. The ATSB used this statement as a reference point to assess the related factors in pilot capability.
Prior knowledge is taken to be familiarity with the content and application of the Pitch Trim Runaway procedure. In this case, RFDS required the pilot to memorise at least the first four items of the Pitch Trim Runaway procedure and addressed this in PC-12 flight training and the recent OPC. Despite mis‑selection of the Trim/Flap Interrupt in this occurrence, the pilot demonstrated familiarity with all of the items of the procedure by addressing each in turn.
Pilatus did not nominate any recall items (also known as memory, phase-1 or bold-faced checks) for PC-12 emergency procedures. In the case of the Pitch Trim Runaway procedure, Pilatus advised the ATSB that their preference would be designation of item 1 as the only recall item to place the focus on the crucial item and positively arrest any trim runaway from any cause. Although the ATSB recognises there are benefits to minimising recall items, there is nothing to indicate that the number of nominated recall items in RFDS procedures were a factor in this occurrence.
The degree of knowledge required for a good understanding of aircraft systems is dependent in part on the complexity of the aircraft and the nature of the pilot-systems interface. Given the relative complexity of the aircraft and regulatory requirements, RFDS provided a PC-12 ground school to the pilot that covered the pitch trim system with reference to the POH/AFM. It would be natural for this theoretical knowledge to be consolidated and/or extended by the PC-12 flying training and operator proficiency checks (OPCs).
Given the pilot was able to recall the emergency procedure and was trained with reference to the Pilot Operating Handbook/Airplane Flight Manual (POH/AFM), the ATSB considered the content and format of the emergency procedure and systems information provided by Pilatus. The associated training/checking aspects are addressed in the following section.
Pitch Trim Runaway emergency procedure
The copy of the Pitch Trim Runaway emergency procedure from Figure 6 is repeated here for ease of reference.
After item 3 of the emergency procedure, the pilot was required to make an assessment and decision about the status of the runaway and act accordingly. This assessment/decision point was defined in the procedure by the condition—‘If trim runaway continues’. Correctly understood, the implication is that the fault is not in the manual trim system and autopilot trim system but in the alternate stabiliser trim circuit.
The alternate stabiliser trim circuit is not used during normal operations and does not require any relays to be energised for operation. As such, the risk that this circuit would fail in an unsafe runaway condition is very low relative to a manual trim or autopilot circuit failure. This was consistent with advice from Honeywell that there was no record of any such failure.
The alternative condition at the assessment/decision point—if trim runaway does not continue—was implied but not specified in the procedure. In this more likely scenario, the fault in the manual or autopilot trim systems has been neutralised by item 2 (opening of Pitch Trim circuit breaker). Then, without any guidance from the procedure, pilots needed to understand that the procedure from item 4 to item 7 should not be continued and alternate stab trim was the only means available to trim the aircraft for the rest of the flight.
Significantly, alternate stabiliser trim was not specified in the procedure until item 8. This had two related adverse effects. First, pilots are not guided to use the alternate stabiliser trim at the point where it almost certainly would be effective at recovering from an out-of-trim condition (after item 3). Second, if the procedure is carried out in a sequential manner, item 5 (Pitch Trim Alternate circuit breaker open) will render item 8 (alternate stabiliser trim) inoperable.
Another consequence of lack of guidance and continuation of the procedure is that item 6 (Pitch Trim circuit breaker—Close) will reactivate the pitch trim runaway in almost all cases.
One of the notes near the end of the Pitch Trim Runaway procedure advised pilots to ‘Reduce speed if control forces are high’. The pilot response to the abnormal control forces was consistent with this advice but the airspeed reached high-risk figures before the pilot took effective action. In this case, the pilot was probably not prompted by the note in the procedure. However, if the note was positioned earlier in the procedure, it is possible that pilot would have acted earlier to reduce the airspeed and risk of loss of loss of control.
Pilatus advised the ATSB that instead of reliance on descriptions within the emergency procedure, the objective of the emergency procedures must be understood and ingrained during training for the procedure to be effectively executed. This was more applicable when the pilot is managing the emergency and unintended consequences. Pilots were directed to SIL-003 for a clear description of the requirements. A copy of SIL-003 is at Appendix B and ATSB assessment of the SIL is in the next section.
The ATSB considered that the PC-12 Pitch Trim Runaway emergency procedure did not clearly define the two conditions for pilot consideration after item 3. In addition, the specified action in response to the most likely condition—pitch trim runaway discontinues (as indicated by no active warnings)—was out of sequence. Given the confounding situation and complexity of the PC-12 pitch trim system, it is likely that a clearly defined and logically sequenced procedure would have assisted the pilot to regain control.
Pitch trim systems information
From an operational perspective, the primary reference for systems information was the POH/AFM. This included the following information relevant to this occurrence:
The alternate stabilizer trim motor could be used as a backup through actuation of the Alternate Stab Trim switch.
In the case of uncommanded trim operation, all trim operation could be stopped by lifting the switch guard and pressing the Trim Interrupt switch.
If a stabiliser trim runaway of the main system is sensed a CAS ‘Pitch Trim Runaway’ warning will be displayed and a ‘Trim Runaway’ will be heard.
The ATSB notes that although this information is helpful to a pilot contending with a pitch trim runaway, it does not provide guidance as to when the Alternate Stab Trim switch should be used or the significance of the CAS warning as an ongoing indicator of system status.
Additional information about pitch trim runaway was available in Pilatus Safety Information Letter SIL‑003. However, RFDS did not incorporate the SIL into their operational reference material and the pilot was not aware of it.
The additional information would have been generally helpful to the pilot and would have emphasised the importance of reduced airspeed in managing the out-of-trim loads. Nevertheless, the ATSB identified missed opportunities in SIL-003 to explain and clarify aspects of pitch trim runaway:
Hands-on training was advised to reduce the risk of erroneously activating the Flap Interrupt switch but pilots were not informed of the associated risk factors, symptoms or corrective action if that occurred.
Information was provided about the purpose of pulling a circuit breaker, without further guidance as to how the affected trim motor would be identified.
Pilots were advised that control of the unaffected systems could be regained by simply repositioning the Trim Interrupt switch to NORM, without guiding pilots to use the Alternate Stab Trim switch.
Neither SIL-003 nor POH/AFM informed pilots/operators that both the manual pitch trim and autopilot pitch trim were powered from the Pitch Trim circuit breaker. In the absence of that information, there is a risk of misapprehension that the autopilot pitch trim was powered from the Pitch Trim Alternate circuit breaker on the (correct) basis that the autopilot pitch trim utilised the alternate trim motor.
A consequence of this misapprehension is that pilots/operators may not realise that the first 3 items (and item 8 as required) of the pitch trim runaway procedure will almost certainly be sufficient to address a runaway condition. There is a risk that pilots will unnecessarily address all of the items in the procedure and not resolve a pitch trim runaway, as happened in this occurrence. The effect of this misapprehension on RFDS training/checking is discussed in the next section.
Another characteristic not covered in the information for pilots applies when the manual trim circuit is the active cause of a pitch trim runway. If the pilot engages manual trim, perhaps instinctively, the CAS warnings are cancelled for the duration of the engagement then reactivate on manual trim disengagement. Pilot awareness of this characteristic might be of assistance in an ill-defined emergency such as this occurrence.
In the context of this occurrence, the ATSB considered that the systems information in the PC-12 POH/AFM did not provide a detailed description of the pitch trim system or effective guidance in the management of a pitch trim runaway. Although SIL-003 presented additional information, it did not effectively compensate for the lack of detailed systems description and guidance in the POH/AFM.
Summary and finding
The PC-12 pitch trim system is complex and the CAS warnings for pitch trim runaway do not specify the malfunctioning circuit or the required actions. As a result, pilots are required to recall and action emergency procedures, interpret system indications, and act accordingly to resolve a pitch trim runaway.
This occurrence demonstrates that the consequences of a pitch trim runaway can be critical if the trim is not interrupted early in the emergency. In the context of this occurrence, the applicable risk controls such as the emergency procedure and systems information did not provide effective assistance to the pilot. The other RFDS pitch trim runaway occurrences did not have critical consequences but indicate variability in the effectiveness of these risk controls.
The relatively experienced pilot involved in three of the previous pitch trim runaway events was familiar with the emergency procedure and POH/AFM but did not interpret the system indications appropriately or act according to the intent of the procedure. During post-occurrence RFDS training/checking, it was apparent that there was variability in pilot understanding of the pitch trim system and associated emergency procedures. Given that variability, the ATSB considered that the occurrence pilot’s relative inexperience was not an important factor in the occurrence.
Pilatus recorded 47 pitch trim runaway events that were associated with defective relays in the manual trim system or the trim adaptor. In those events, the only method available to adjust the trim was use of the Alternate Stab Trim switch, which was reported in 11 of the events (one was unsuccessful). Taking into account those 11 events and the 3 events where the emergency procedure was not fully actioned due to the operational context, there were 33 pitch trim runaways where pilot use or non-use of Alternate Stab Trim is unknown. As such, there is insufficient information to derive a conclusion from the Pilatus data regarding pilot understanding of the pitch trim system and emergency procedure.
Given the pilot in this occurrence was familiar with the emergency procedure and trained by qualified personnel with reference to the POH/AFM, the ATSB considered the content and format of the emergency procedure and systems information in the POH/AFM in the context of RFDS and Pilatus occurrence data.
The ATSB found that the emergency procedures and systems information in the PC-12 POH/AFM and Quick Reference Handbook (QRH) did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this case, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.
RFDS training and checking
The pilot’s capability to implement the Pitch Trim Runaway emergency procedure with a good understanding of the aircraft systems relied to a large extent on the training and checking provided by RFDS. Their training and checking organisation conducted the required ground school and flight training to qualify the pilot to operate the PC-12 aircraft type. This was supplemented by supervised line flying (LOFT) and operator proficiency checks (OPC) as specified by RFDS.
The PC-12 ground school was the primary means for RFDS to equip the pilot with the requisite knowledge of a wide range of aircraft systems. This included the pitch trim system, which was addressed with reference to the POH/AFM and as part of a guided inspection of an aircraft. Given the POH/AFM did not provide a detailed description of the pitch trim system and RFDS training/checking pilots were unaware of some characteristics, the information provided to the pilot accordingly had some limitations.
By the time the pilot was trained in 2018, Pilatus had issued SIL-003 (in 2017) as a reminder of the trim runaway procedures in the POH/AFM and to highlight decision-making considerations after the trim runaway condition is stopped. RFDS had not formally considered this document and it was not a supplementary reference in the ground school. Although this document would have been generally helpful to the ground school facilitator and this pilot, the focus of the SIL was operational and it did not provide any further significant detail about the pitch trim system. As such, the absence of the SIL from the ground school references was not considered to be a factor in the occurrence.
Although systems knowledge is not the prime focus of flying training, supervised line flying or operator proficiency checks, these processes generally help to consolidate the pilot’s understanding of aircraft systems and might show if there were any critical knowledge deficiencies. There was no indication of any such deficiencies.
The PC-12 flying training and operator proficiency checks were the primary means for RFDS to develop and verify the pilot’s capability to manage in-flight emergencies such as pitch trim runaway. These training/checking activities were oriented to the recall and practice of the applicable emergency procedures in the QRH. As a result, it could be expected that the pilot was familiar with the content of the procedures and location of the applicable switches and circuit breakers.
Although the pilot was able to recall the items in the emergency procedure, the initial switch selection was incorrect and the pilot actioned further items of the procedure without resolving the severely out-of-trim condition. The ATSB considered two aspects of the training/checking processes that might have played a role.
First, the practice exercises for pitch trim runaway were not consistent with the likely failure modes and recovery actions. Prior to this occurrence, RFDS operated on the basis that the manual trim was powered from Pitch Trim circuit breaker and the autopilot trim (utilising the alternate trim motor) was powered from the Pitch Trim Alternate circuit breaker. As a result, in response to a practice pitch trim runaway, pilots were expected to complete the first stage (items 1-3) at a minimum and it was common to continue the procedure (items 4-8) to represent an autopilot-related runaway scenario.
Actually, both manual and autopilot systems are powered from the Pitch Trim circuit breaker so the first stage (items 1-3) and item 8 (as required) of the emergency procedure are sufficient to manage a pitch trim runaway in all recorded cases to date. In the absence of a clear definition of failure modes, the pilot was conditioned to continue the emergency procedure beyond the first stage without use of the Alternate Stab Trim.
RFDS misunderstanding of the pitch trim system can be attributed in part to the lack of specific detail in the POH/AFM and unclear definition of the likely fault conditions in the emergency procedure. Although there was a report of some consideration of SIL-003 and consequent inclusion of pitch trim runaway scenarios in checks, RFDS did not formally consider the implications for their training/checking practices.
The key piece of additional information provided by the SIL was the advice:
Hands-on training reduces the activation time and minimizes the risk of erroneously activating the “Flaps Interrupt” system switch (which cannot be reset in-flight).
In the pre-occurrence context, with no instances of mis-selections in occurrences or training/checking, it is unclear if RFDS would have adopted that practice as an exception to the touch-drill principle. Nevertheless, Pilatus consider SIL-003 to be effective additional guidance for the management of a pitch trim runaway.
Second, the RFDS training/checking was carried out in-aircraft and this has inherent and unavoidable constraints for the practice of some emergencies. It is not technically feasible or necessarily safe to initiate a pitch trim runaway in the aircraft so the training/checking pilot described a scenario and/or discreetly made a flight control input. Accordingly, the trainee did not experience the realistic effects of a pitch trim runaway with the applicable CAS indications. Then, the pilot generally responded with a touch-drill and did not fully experience the physical action and system feedback.
As a consequence of both aspects, the occurrence pilot had developed an expectation that selection of the Trim Interrupt to INTR should have stopped the dive and the opened circuit breaker should have relieved the situation. In reality, the trim interrupt function simply stops the trim where it is and the opened circuit breaker does not provide any further relief at that point.
The ATSB found that the effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems information and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).
Relay failure
The ATSB examined the defective manual pitch trim DOWN relays removed from VH-OWJ and another PC-12 that sustained a pitch trim runaway. In both relays, one set of the normally open contacts were fused together in a similar way. According to the relay manufacturer, this type of damage was consistent with a short-duration high-current event such as a lightning strike.
The transfer of material between contacts in the manual pitch trim UP relay removed from VH-OWJ and the manual pitch DOWN relay from the other PC-12 showed that the related circuits had been subjected to regular arcing.
Based on examination of the three manual pitch trim relays from two different aircraft, the ATSB considered that the risk of surge voltage and over current in the PC-12 pitch trim system was probably not limited to a particular aircraft. The relay failures recorded by RFDS and Pilatus in connection with pitch trim runaway events are indicative of the same failure mode. Considering the near identical failure mode within the same pitch trim relay of varying aircraft, it is less likely that the cause would be a random event such as a lightning strike. The ATSB considers that the failure is more likely due to a characteristic associated with the pitch trim circuit, such as potential surge currents cause by switching the inductive load of the pitch trim actuator.
At the time of the occurrence Pilatus had identified a reliability issue concerning the mechanical relays in the PC-12 pitch trim system. This is consistent with the ATSB’s concern that a characteristic of the pitch trim circuit may have contributed to the relay failure.
Pilatus have developed service bulletins to introduce solid-state relays into the pitch trim power circuits. The ATSB notes that solid-state relays are also susceptible to failure from surge voltages. A typical failure mode for solid-state relays is short-circuit, in which case the load would not be turned off and a pitch trim runaway would occur.
Although Pilatus service bulletins SB 27-023 and SB 27-024 address the reliability of relays in the pitch trim system, the ATSB considers that the risk of pitch trim runaway may not be significantly reduced. As such, Pilatus may need to conduct further research into the electrical loads present in the PC-12 pitch trim system to identify and address the source of the high energy events that damage relays.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Pilatus Aircraft Ltd.
Honeywell Aerospace
Royal Flying Doctor Service – Western Operations
Pilot and medical crew of VH-OWJ
RFDS pilots involved in other pitch trim runaway occurrences
Royal Flying Doctor Service – Central Operations
Transport Canada.
References
Dismukes, R., Goldsmith, T. E., & Kochan, J. A. (2015). Effects of acute stress on aircrew performance: literature review and analysis of operational aspects.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, Transport Canada, Swiss Transport Safety Board, Pilatus Aircraft Ltd, Honeywell Aerospace, Royal Flying Doctor Service – Western Operations, the pilot and medical crew of VH-OWJ, and Royal Flying Doctor Service – Central Operations.
Submissions were received from the Civil Aviation Safety Authority, Swiss Transport Safety Board, Royal Flying Doctor Service – Western Operations, and Pilatus Aircraft Ltd. Those submissions were reviewed and where considered appropriate, the text of the draft report was amended.
Findings
From the evidence available, the following findings are made with respect to the pitch trim runaway and partial loss of control involving a Pilatus PC-12/47E, registered VH-OWJ that occurred near Merredin, Western Australia on 14 April 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
Soon after take-off in dark-night conditions, the pitch trim system continued to operate in a nose-down direction without pilot input or autopilot commands (pitch trim runaway) because of a malfunctioning relay in the manual (main pilot-engaged) stabiliser trim system.
In response to the Crew Alerting System warnings, the pilot initiated the Pitch Trim Runaway emergency procedure but inadvertently selected the Flap Interrupt switch rather than the Trim Interrupt switch (item 1). Consequently (before the next checklist item was actioned), the pitch trim continued to runaway until it reached full nose-down with associated serious control difficulties.
After the pilot addressed items 2 and 3 of the emergency procedure, the malfunction was neutralised and the alternate stabiliser trim system was available to adjust the trim. However, the pilot did not identify those positive conditions and continued with items 4 to 8 of the procedure, which disabled the alternate stabiliser trim system, prevented pitch trim adjustment and prolonged the serious control difficulties.
The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
The emergency procedures and systems information in the PC-12 Pilot’s Operating Handbook/Airplane Flight Manual and Quick Reference Handbook did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this case, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.
Other factors that increased risk
As the (uninterrupted) pitch trim runaway progressed, the reinforcing cycle of increasing control loads, forced descent, and increasing airspeed was initially exacerbated by high engine torque. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
The effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems knowledge and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).
Other findings
The PC-12 Crew Alerting System (CAS) provided clear and salient warnings of the pitch trim runaway and indications of the ongoing status of the pitch trim system. As was typical for aircraft such as the PC-12, the CAS was not designed to specify the malfunctioning circuit.
In difficult operational circumstances, the pilot enlisted the assistance of non-flying crew to counter the very high control loads and managed to coordinate the dual control inputs to return and land without wing flap at Merredin.
At the time of the occurrence, the aircraft manufacturer was developing and implementing replacement components for the pitch trim system to improve reliability. Further research into the electrical loads present in the PC-12 pitch trim system may be required to find and address the source of high energy events that damage the relays.
Appendices
Appendix A – PC-12/47E Pitch trim system wiring diagram
The ATSB adapted this circuit diagram from the maintenance data produced by Pilatus to show the status of key components of the system at the time of the pitch trim runaway. The red lines trace the active power circuit through the malfunctioning relay. That circuit can be de-energised by the Trim Interrupt switch and/or Pitch Trim circuit breaker. The blue lines trace the power circuit that can be activated by the Alternate Stab Trim switch provided the Pitch Trim Altn circuit breaker is closed and the Trim Interrupt switch is NORM.
Note, both pilot and autopilot controlled pitch trim circuits are powered via the Ess Bus and Pitch Trim circuit breaker. The Main Bus and Pitch Trim Altn circuit breaker only powers the Alternate Stab Trim circuit.
Figure A1: PC-12/47E Pitch trim system wiring diagram
Source: Adapted from Pilatus PC-12 maintenance data by the ATSB
Appendix B – Pilatus PC-12 Safety Information Letter SIL-003
Source: Pilatus Aircraft Ltd.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
RFDS Western Operations
RFDS safety, quality and risk personnel carried out an investigation of the occurrence with a focus on the cause of the pitch trim runaway and the actions of the pilot and crew in response to the event. This resulted in six recommendations and the following safety action by RFDS:
Pilatus was asked to investigate more reliable relays for the pitch trim system.
Feedback was provided to Pilatus regarding the Pitch Trim Runaway emergency procedure and the potential to change it to reduce confusion.
RFDS considered that the timing of the initial engine torque reduction (when the airspeed reached 210 kt) led directly to a situation where the aircraft and crew were placed at catastrophic risk. With reference to the RFDS Just Culture process, this was considered to be negligent and, taking into account the pilot’s other incidents, the pilot’s employment was terminated.
RFDS amended the PC-12 operating procedures in their Operations Manual to present the first phase of the pitch trim runaway emergency procedure in accordance with the Pilatus PC-12 POH/AFM and QRH.
The RFDS Head of Training and Checking convened a review of the adequacy of processes in regard to pitch trim runaway. This led to the following activities:
Briefing on revised pitch trim system information to all PC-12 pilots
Development of a training presentation to describe operation of the pitch trim system
For PC-12 conversion, addition of training between ground school and flight training to provide opportunity for pilots to review and if possible physically action emergency procedures in an aircraft on the ground
Refresher training for pitch trim runaway for all PC-12 pilots on next scheduled checks
For a practice pitch trim runaway, pilots were now expected to physically action the Alternate Stab Trim switch
Provision of the RFDS investigation report (with redactions for privacy) to all PC-12 pilots.
Following the occurrence, senior training and checking personnel had the opportunity to participate in a modified PC-12/47E ground school and simulator flight refresher course provided in the US by Flight Safety International. This included a pitch trim runaway scenario with similar complications to the occurrence.
A number of recommendations were proposed including:
Enhancement to the PC-12 ground school with more emphasis on emergency procedures and their impact on aircraft systems
Consideration of practice to retard the engine power lever as initial response to pitch trim runaway for better access to Trim Interrupt switch and enhance control of airspeed and control forces.
Where possible, allow pilots to physically action controls such as Alternate Stab Trim that are specified in a drill
Opportunities for training pilots and all PC-12 pilots to practice emergency scenarios in a full motion simulator.
Context
Pilot information
The pilot held a commercial pilot licence with aeroplane category rating, an instrument rating with multi-engine aeroplane endorsement, and a Flight Instructor Rating. On application to RFDS in May 2018, the pilot’s total aeronautical experience was 1,587 hours. This included 1,370 hours as pilot in command, 384 hours multi-engine (Piper PA-31 Navajo and PA-34 Seneca), and 154 hours instrument flight time.
After joining RFDS in July 2018, the pilot received the specified training and assessment for a new pilot without prior PC-12 or similar aircraft type operating experience. This included:
Pilot induction training – including use of flight check system
Ground school - PC-12/47E (NG) Engineering Course
Human Factors and Non-Technical Skills Refresher Course
Flight training with flight review in PC-12/47E aircraft
Line Oriented Flight Training (medical transport flights with supervisory pilot)
Instrument Proficiency Check
Check-to-line assessment – passed in September 2018.
Training and check records indicate that the pilot progressed without any significant difficulties. The training/check pilot who approved the pilot for line operations recommended that, due to the pilot’s relatively low experience level, a follow-up check be conducted earlier than the required 6 months.
During the first three months of PC-12 operation as a line pilot, the pilot inadvertently exceeded an engine limit on take-off, and extended the landing gear above the maximum landing gear operating airspeed. RFDS investigated the landing gear exceedance and found that the pilot accepted an amended route, was then high on approach, and checked the airspeed, but did not recognise the high speed before extending the gear. As recommended, the pilot was debriefed/counselled with plans to simulate a similar scenario at the next check.
In February 2019, the RFDS Head of Training and Checking (HOTAC) conducted a Progress Check with the pilot during daylight in visual meteorological conditions. This included a pitch trim runaway scenario after take-off that required the pilot to carry out the emergency procedure. The HOTAC advised that the pilot’s response was in accordance with the Pilatus PC-12 Quick Reference Handbook (QRH). There was no record of a specific scenario similar to the landing gear exceedance. The overall assessment was satisfactory/competent and the pilot continued as a PC‑12 line pilot for the next two months until the occurrence.
At the time of the occurrence, the pilot’s total aeronautical experience was 2,108 hours including 521 hours on the PC-12/47E aircraft type. The pilot held a Class 1 medical certificate valid until February 2020.
Aircraft information
The PC-12/47E is a large single-engine turboprop pressurised aircraft designed and built by Pilatus Aircraft Ltd in Switzerland. This aircraft was manufactured as serial number 1411 in July 2013 and registered VH-OWJ in October 2013. At the time of the occurrence, the total time in service was recorded as 7,377 hours.
The aircraft was maintained by the CASA-approved RFDS maintenance organisation in accordance with an authorised system of maintenance based on the Pilatus Progressive Inspection Phases. At the time of the occurrence, a maintenance release[3] was in effect for the aircraft.
The most recent scheduled maintenance was a Progressive Mini Inspection completed on 28 March 2019 at 7,311 hours’ total time in service. This included a functional check of the Trim Interrupt switch, Alternate Stabiliser Trim switch and runaway aural warning system. No defects were recorded.
There were no significant deferred defects or line maintenance recorded before the occurrence. The pilot who operated the aircraft on the previous shift earlier that day did not record any issues with the aircraft.
PC-12 flight control systems
Pitch trim system
The primary flight controls—aileron, elevator and rudder—are actuated through a conventional system of push-pull rods and carbon steel cables. Each primary control is equipped with an electrically operated (DC) trim system to alleviate the variable aerodynamic loads transmitted by the control system. A visual indication of trim position is displayed to the pilot on the multi-function display (see Pitch trim runaway warnings).
For pitch trim (nose up/down, related to elevator control loads), the leading edge of the ‘T-tail’ horizontal stabiliser is moved up and down through a defined range by an actuator. This actuator contains two separate electric motors that operate independently according to three different control inputs. The ATSB developed a schematic diagram of the three pitch trim power circuits (Appendix A). Refer to Figure 4 for trim system features.
One of those trim motors—manual stabiliser trim motor—provides the primary means for the pilot or copilot to adjust the pitch trim. When the pilot selects the pilot trim engage switch and trim up/down switch on the control wheel simultaneously, the trim control circuit energises the up or down pitch trim relay.[4] That connects power from the Essential Bus and Pitch Trim circuit breaker through the applicable relay contacts to the manual stabiliser trim motor then circuit to earth via the de-energised relay.
In normal operation, trim movement will cease once the pilot releases the switches. However, in this occurrence, the pitch trim down relay stuck closed and continued to provide power to the manual stabiliser trim motor until the pitch trim circuit breaker was opened.
The other trim motor—alternate stabiliser trim motor—is utilised by either the autopilot or the alternate stabiliser trim switch (labelled as ‘Alternate Stab Trim’). When the autopilot is controlling the pitch trim, the auto drive circuit (from the Modular Avionics Unit) energises the up or down auto pitch trim relay in the Trim Adapter. That connects power from the Essential Bus and Pitch Trim circuit breaker through the respective relay contacts (and auto pitch trim engage relay) to the alternate stabiliser trim motor then circuit to earth via the relays.
The Alternate Stab Trim switch is located on the front centre console. When the autopilot is disengaged, selection of the switch to the nose up or down position provided power from the Main Bus and Pitch Trim Alternate circuit breaker (through the de‑energised auto pitch trim engage relay in the Trim Adapter) to the alternate stabiliser trim motor.
All of the trim power circuits (including rudder and aileron trim) were routed through a ‘Trim Interrupt’ switch located on the front centre console. When this switch was in the default position of NORM (normal), it closed the circuit between the various circuit breakers and related components in each system to allow normal operation. If this switch was selected to INTR (interrupt), it opened every trim power circuit simultaneously and prevented all trim operation until the switch was returned to NORM. (This switch was guarded with a clear perspex cover. All switch labels were backlit).
The ATSB highlights that although the autopilot trim system utilises the alternate stabiliser trim motor, it is powered from the same source as the manual trim system (Pitch Trim circuit breaker) rather than the power source for alternate stabiliser trim (Pitch Trim Alternate circuit breaker). This detail was not explicitly covered in the PC-12 Pilot’s Operating Handbook and Airplane Flight Manual (POH/AFM) and RFDS pilots advised they were not aware of that design characteristic. As discussed in Safety analysis, this had a subtle effect on training/checking practices and interpretation of the pitch trim runaway emergency procedure.
A representative of Honeywell Aerospace, the designer and provider of in-service support for the pitch trim system, advised the ATSB that there was no documented instance of a runaway attributed to the alternate stabiliser trim circuit (Appendix A – blue lines).
Figure 4: Pilatus PC-12/47E trim system features
Source: Pilatus and ATSB
Pitch trim runaway warnings
The pitch trim system monitored the power and control circuits for both trim motors and detected when there was power applied but no corresponding manual trim engagement, autopilot trim drive signals, or alternate stabiliser trim command. In any of those cases, the crew alerting system (CAS) produced the following effects:
master warning or caution light illuminated
‘Trim Runaway’ aural alert
‘Pitch Trim Runaway’ message displayed in the CAS window of the systems multi-function display (Figure 5).
Once the master warning or caution is acknowledged, the aural alert is cancelled but the message continues to display while the out-of-limit condition such as a trim runaway is operative. In the case of a malfunctioning relay in the manual trim system (such as this occurrence), the message will disappear if any of the following actions are carried out:
Manual trim engage switch on control wheel is activated
Trim Interrupt switch is selected to INTR
Pitch Trim circuit breaker is pulled open.
The ATSB notes that conditions 2 and 3 will cancel the message and stop a related runaway but condition 1 will only cancel the message without any effect on a runaway condition. The recorded data showed that the pitch trim runaway warning was cancelled and reactivated three times in the 32-second period after the initial warning. This was consistent with the pilot attempting to use the manual trim, which was ineffective in resolving the runaway.
Figure 5: Sample multi-function display showing acknowledged CAS messages
Source: Pilatus
Wing flaps
The wing flap system is electrically actuated and controlled by a selector handle on the centre console to the right of the engine control quadrant. Located forward of the flap selector handle is a Flap Interrupt switch (Figure 4) that disables normal operation of the flap system and generates a ‘Flap’ caution message on the CAS if the switch is selected to INTR. Irrespective of subsequent switch selections, the flaps will not operate until reset on the ground.
In this occurrence, there was evidence from flight data of power being removed from the flap system at the beginning of the initial 16-second trim runaway event, consistent with the operation of the Flap Interrupt switch (see Figure 3 - dark blue trace coded as Flap Controller Fail).
Pilatus advised the ATSB that the Flap Interrupt switch was utilised in the original PC-12 wing flap design as part of the alternate flap switch circuit that allowed the pilot to correct a flap asymmetry. In the PC‑12/47E model, there is no pilot access to the alternate flap switch and no requirement for the pilot to operate the remaining Flap Interrupt switch.
The ATSB notes that, as can be seen in Figure 4 (bottom right), the Flap Interrupt switch and Trim Interrupt switch appear to be the same type of switch and are located on the same panel, either side of the Alternate Stab Trim switch (refer to the following Safety analysis section).
Aircraft operating procedures – Pilatus
Pilot’s Operating Handbook and Quick Reference Handbook
The primary reference for operation of the PC-12/47E is the Pilot’s Operating Handbook and EASA Approved Airplane Flight Manual (POH/AFM) produced by Pilatus. In Section 3 Emergency Procedures, the general comments include the following guidance:
Some situations require rapid action, leaving little time to consult the emergency procedures. Prior knowledge of these procedures and a good understanding of the aircraft system is a prerequisite for safe aircraft handling.
The emergency procedures included a sequential list of action items in case of a pitch trim runaway. These procedures were also presented in the Quick Reference Handbook Emergency Procedures (QRH) booklet produced by Pilatus and available in the cockpit for the pilot to consult as required and as circumstances permitted (Figure 6).
Pilots could also select this procedure as one of the electronic emergency checklists on the multi-function display. This operation required a number of button pushes to select the checklist and scroll through the items. RFDS did not advocate use of this feature and that practice was not a factor in this occurrence.
Pilatus advised that if item 1 of the procedure was carried out immediately following a pitch trim runway warning, the control forces would be acceptable and the pilot would be able to perform the subsequent actions without acute stress.
The ATSB noted that in the scenario where items 1-3 would neutralise a pitch trim runaway condition, the subsequent control forces experienced by the pilot could be uncomfortably high due to timing of the trim interrupt or changes to phase of flight and/or aircraft configuration. If that occurs, the pilot can only adjust pitch trim using the alternate stabiliser trim. The procedure, however, did not communicate that clearly and specified alternate stabiliser trim as item 8.
It should also be noted that item 8 will not be effective if the complete procedure is actioned in numerical sequence. In that case, action in accordance with item 5 to open the Pitch Trim Alternate circuit breaker disconnects power from the alternate stabiliser pitch trim circuit. As the pilot in this occurrence found, any subsequent attempts to use the alternate stabiliser trim switch in accordance with item 8 will be futile.
Supplementary information
In February 2017, Pilatus issued Safety Information Letter (SIL) 003 to all customers, operators and service centres as an ‘Important reminder of procedures and operations of PC-12 (all models) when encountering a trim runaway condition.’ For reference, a copy of this letter is at Appendix B.
Some points from the letter that are relevant to this occurrence:
In the case of a trim runaway condition, as an immediate action, activate the guarded “Trim Interrupt” switch (refer to POH Section 3).
Hands-on training reduces the activation time and minimizes the risk of erroneously activating the “Flaps Interrupt” system switch (which cannot be reset in-flight).
By pulling its associated Circuit Breaker (CB), the affected trim motor will be isolated before the pilot can attempt to regain control of the unaffected systems (refer to POH Section 3).
To regain control of the unaffected systems, simply reposition the “Trim Interrupt” switch to NORM (refer to POH Section 3).
A reduction in airspeed will significantly reduce the existing out-of-trim forces and will help the pilot regain full control of the aircraft (refer to POH Section 3).
The PC-12 trim system is designed to assure that the pilot does not have to counteract continuous or excessive control forces after encountering a trim runaway. In case of a runaway on one of the pitch trim motors, the remaining one can be used to regain normal control forces.
Pilatus advised the ATSB that RFDS confirmed receipt of the transmittal notice for SIL-003 on 7 March 2017. Since then, the SIL has been listed as one of the additional technical information items on the Pilatus document portal accessible to RFDS. Pilatus noted that the SIL is also publically available on their website.
The ATSB notes that RFDS did not have a record of having received or formally considered the operational implications of this letter. One of the training/check pilots recalled the letter and advised that RFDS incorporated the pitch trim runaway response from the QRH into check flights. The content of the letter and potential effect in this occurrence is considered in the following Safety analysis section.
Normal procedures
As part of the POH/AFM Normal Procedures section, the daily Pre Flight checklist included items to confirm that the Trim Interrupt and Flap Interrupt switches were in the NORM/GUARDED positions. These were visual checks that did not involve operation of the switches. RFDS normal procedures were consistent with the POH/AFM.
For PC-12 aircraft operated under Transport Canada airworthiness approval, Pilatus specified a daily check of the pitch trim interrupt system in the ‘Before Starting Engine Procedure’. This originated in 1997 as part of the aircraft certification review process by Transport Canada. Transport Canada considered that the trim interrupt system was the sole means of disconnection for an uncommanded runaway and the system failure analysis did not take into account all of the factors. Pilatus responded by including a periodic check of the trim interrupt function in airworthiness limitations and integrating the daily check into the Canadian-specific POH/AFM.
Aircraft operating procedures – RFDS
The RFDS Operations Manual specified general aircraft operating procedures and PC-12 operating procedures. As a general principle, RFDS required pilots to comply with all requirements, instructions, procedures, or limitations in the applicable POH/AFM and QRH.
In an emergency, pilots were required to action the defined recall items from memory and then refer to the appropriate written procedures for confirmation. The subsequent actions were then to be actioned/confirmed as necessary and any notes/warnings reviewed. It was acknowledged that in some circumstances, pilots might need to continue subsequent actions from memory.
The pilot advised that the physical demands of counteracting the serious out-of-trim condition did not allow for review of the procedure in the QRH booklet. In context, this was an unavoidable constraint of single-pilot operation and was not considered to be a factor in the occurrence.
From March 2019 onwards, the RFDS PC-12 operating procedures nominated the first four items of the Pitch Trim Runaway procedure as recall items. These items were recorded in the operations manual and were the same as the POH/AFM and QRH except for item 3 which incorporated a conditional phrase:
3. TRIM INTERRUPT switch if trim runaway continues … NORM
In the POH/AFM and QRH, this conditional followed item 3 and applied to item 4 onwards rather than item 3.
Item 3, as presented by RFDS, could be interpreted to mean that the power to the trim systems was only to be reinstated if the trim runaway continued. However, the trim runaway could not continue without the reinstatement of power through the Trim Interrupt switch (and almost certainly the Pitch Trim circuit breaker), so the phrasing was nonsensical. In the context that the trim interrupt remained in NORM, and the POH/AFM/QRH procedures were primary references, it is unlikely that the procedural inconsistency had any effect on this occurrence.
RFDS advised that the recall items for emergency procedures had recently been added to their PC-12 operating procedures as an update to reflect current practices. They were aware that the RFDS pitch trim runaway procedures varied from the POH/AFM and QRH as a result of inaccurate transcription but this had not been communicated to pilots. This was corrected after the occurrence.
Pilot training and checking – RFDS
Training and checking framework
RFDS held a Civil Aviation Safety Regulation (CASR) Part 141 certificate and operated a CASA‑approved Training and Checking organisation under Civil Aviation Regulation (CAR) 217. The Part 141 certificate authorised RFDS to conduct the required class rating flight training and flight review to qualify pilots for the PC-12 aircraft type. (RFDS referred to this as conversion training.) The CAR 217 approval authorised RFDS to conduct recurrent training and checking including regular operator proficiency checks (OPCs).
The first stage of the RFDS PC-12/47E ‘conversion training’ was a 6-day ground school facilitated by an experienced PC-12 instructor in accordance with a Facilitators Guide. Reference material included the POH/AFM, QRH, engineering training manual, PowerPoint presentations, videos, cockpit mock-up, components, and an aircraft. Information about the pitch trim system was available from the POH/AFM and a guided inspection of an aircraft. Learning assessments were carried out during and at the end of the course.
The second stage of PC-12/47E conversion training was flight training in the aircraft in accordance with a flight training syllabus. This was usually carried out over 5 flights and approximately 12 flight hours. The syllabus included review of CAS warnings/cautions such as Pitch Trim Runaway and use of the QRH. A flight review was incorporated into this training.
Following conversion training, pilots completed 50-100 hours of line oriented flight training (LOFT) with a training/check pilot or supervisory pilot in the aircraft. RFDS specified a number of competency items and discussion topics to be covered during LOFT. These did not specifically include Pitch Trim Runaway.
When pilots had completed all of the LOFT elements and were considered ready, a check pilot conducted a check-to-line assessment consisting of at least two sectors, one night sector, and a minimum of two instrument approaches. RFDS specified a number of elements to be assessed during normal operation and some emergency/abnormal scenarios. These did not include Pitch Trim Runaway.
Once a pilot was checked to line, recurrent checking consisted of two checks in any 365-day period. One of those checks was an instrument proficiency checks (IPC) to satisfy the regulatory requirements of CASR Part 61. The alternate check was an OPC that consisted of a technical quiz and flight sequences to assess pilot response to at least four emergency scenarios. In addition, an annual line check was carried out to allow assessment of a medical flight sector.
Training and checking practices – pitch trim runaway
In the RFDS training and checking framework, it was a requirement that the emergency procedures in the QRH were addressed during PC-12 conversion training, check-to-line, OPC, and as required for IPC. RFDS identified six critical manoeuvres with an increased level of threat (such as emergency descent and engine failure after take-off) that required specific assessment during OPCs. Other emergencies, such as Pitch Trim Runaway, could be addressed in an OPC at the discretion of the check pilot.
Pilatus did not recommend a method for in-flight practice of Pitch Trim Runaway, other than the guidance provided in Safety Information Letter SIL-003 that there was a benefit to hands-on training for correct operation of the Trim Interrupt switch. Although RFDS specified techniques for their training/check pilots to use in simulating some emergencies such as engine failures, there was no documented method for pitch trim runaways. The ATSB derived information about practices from interviews with RFDS training/check pilots including those involved in the pilot’s training and checking.
It was not possible to replicate a pitch trim runaway in a serviceable aircraft nor would that be desirable in-flight. As such, it was common practice for RFDS training/check pilots to introduce a pitch trim runaway scenario by annunciating the warning callout ‘Trim Runaway’ and advising of the associated CAS warning message. The physical effects might be described by the training/check pilot, or represented either by using the alternate stab/manual trim to provide trim input or by application of a progressive force to the control column.
Training/check pilots expected pilots to respond by recalling and following the Pitch Trim Runaway procedure, starting with item 1 - identification of the Trim Interrupt switch. There was variation as to whether the switch was actually selected to INTR or whether this action was indicated in accordance with the touch drill principle. At this point, the training/check pilot would generally stop trim inputs or release force on the control column, as the case might be. The ATSB notes that trim interruption will stop trim inputs but will not alleviate control forces developed to that point.
If the training/check pilot initiated the pitch trim runaway on final approach, the likely outcome was a landing without a requirement for further actions from the emergency procedure. In all other situations, training/check pilots would expect that the pilot would proceed with further items of the procedure. For actions involving circuit breakers (items 2, 5, 6), it was a general principle that these were not pulled opened during practice of emergencies to prevent inducing problems in electrical systems. As such, the circuit breaker action items would be effected through touch drills or referenced by the pilot in discussion with the check pilot.
Although the end-point of a pitch trim runaway scenario was not defined and could vary according to the operational context, it was common for check pilots to facilitate the exercise so the complete procedure was addressed. This was consistent with a general misunderstanding in RFDS that the autopilot trim was powered through the Pitch Trim Alternate circuit breaker (rather than Pitch Trim circuit breaker). Consequently, it was perceived that items 4 onwards of the emergency procedure (Figure 6) may be required to address a malfunction in the autopilot trim system. On completion of the procedure, the check pilot could restore normal trim operation or might advise the pilot to use the alternate stab trim for trim operation during the next phase of flight.
In assessing pilot response to a pitch trim runaway scenario, training/check pilots were focussed on pilot recall of the QRH emergency procedure items and correct identification/confirmation of the applicable switches and circuit breakers. The representation of pitch trim runaway and effects of indicative actions did not consistently reflect actual behaviour of an aircraft during such an emergency.
The pilot of this occurrence expected that the control problems would be rectified when the Trim Interrupt switch was selected to INTR. If the pilot had promptly made that selection as intended, the control loads would have been manageable but the loads would not have been alleviated.
Following the occurrence, RFDS training/check pilots noted that the power control lever could obscure the Trim Interrupt switch when the lever was in the maximum position (used for take-off and initial climb). The ATSB confirmed that this was the case if the pilot’s seat was adjusted to provide a standardised field of vision with reference to the visual alignment device.
Pitch trim runaway occurrences
RFDS Western Operations
RFDS advised of seven pitch trim runaway events involving their PC-12 aircraft, including this occurrence. The ATSB requested data about these events and compiled the following table. For context, please note that all of the aircraft were PC-12/47E NG models and each of the events involved different registrations.
Table 1: RFDS Western Operations Pilatus PC-12/47E pitch trim runaway events
Ref
Occurrence date
Aircraft hours
Occurrence description
Fault
1.
10 June 2013
N/A
Single pilot operation – Day.
On approach at 500 ft, pitch trim runaway nose-up.
QRH recall items including Trim Interrupt carried out.
Nil use of Alternate Stab Trim. Reported use of manual trim.
Missed approach, normal landing.
Manual trim relay.
2.
5 May 2015
7,631
Two pilot (LOFT) operation - Day.
On approach at 300 ft, pitch trim runaway nose-up.
QRH first recall item – Trim Interrupt only carried out (due context).
Nil use of Alternate Stab Trim – not applicable.
Normal landing.
Manual trim relay.
3.
17 February 2017
3,821
Single pilot operation - Day.
On final approach, pitch trim runaway nose-down.
QRH recall items including Trim Interrupt carried out.
Alternate Stab Trim switch used to adjust trim.
Normal landing.
Manual trim relay.
4.
22 August 2018
11,912
Two pilot (LOFT) operation - Day.
On downwind approach, pitch trim runaway nose-up.
QRH recall items including Trim Interrupt carried out.
Nil use of Alternate Stab Trim.
Normal landing.
Trim adaptor (autopilot related).
5.
19 January 2019
3,431
Single pilot – Day.
On descent with autopilot on, pitch trim runaway.
QRH recall items including Trim Interrupt carried out plus Pitch Trim – Alternate circuit breaker pulled.
Nil use of Alternate Stab Trim.
Diversion and normal landing.
Trim adaptor (autopilot related).
6.
14 April 2019
(occurrence)
7,377
Single pilot – Night.
After take-off, pitch trim runaway nose-down.
QRH recall items carried out but Trim Interrupt mis-selected. Control difficulties. Further items.
Nil use of Alternate Stab Trim.
Return for flapless landing with control difficulties.
Manual trim relay.
7.
3 August 2019
(post occurrence)
12,272
Two pilot (LOFT) operation - Day
After take-off, pitch trim runaway nose-down.
Recall items including Trim Interrupt carried out.
Alternate Stab Trim switch used to adjust trim.
Return for normal landing.
Manual trim relay.
The ATSB reviewed the occurrence descriptions and maintenance records for the five pitch runaway events recorded before the occurrence, and interviewed the pilots involved except for one trainee pilot who was no longer with RFDS.
In one of those events (Ref. 2), the aircraft was on short final and the pilot operating under supervision carried out item 1 of the procedure then landed the aircraft. The training/check pilot advised the ATSB that the aircraft was controllable and there was no requirement or time to action further items of the procedure before landing.
In another event (Ref. 3), the pilot was on approach and the pilot actioned the recall items followed by appropriate use of the Alternate Stab Trim switch. The pilot advised the ATSB that knowledge of the system was gained from RFDS training/checking and from self-study.
In the other three events (Ref. 1, 4, 5), the same pilot was involved as pilot in command including one event under supervision of a training pilot. The pilot involved in the three events had joined RFDS in 2012. Prior to that, the pilot was employed as a corporate jet pilot for 3 years. In 2019, the pilot’s total experience was 11,900 hours including 3,000 hours on the PC-12. These three events are noteworthy in that the Alternate Stab Trim switch was the only means available to adjust trim but was not utilised following the recall items, and there were anomalies in the pilot in command’s technical understanding of the events and pitch trim system.
The pilot response to the first pitch trim runaway was consistent with the recall items of the procedure but the pilot did not realise that manual trim was consequently inoperative and was not aware that the Alternate Stab Trim could be used for trimming. In response to the two other events, the pilot continued the emergency procedure beyond the recall items and in at least one case pulled the Pitch Trim Alternate circuit breaker. That was not consistent with the recorded fault and it is not clear if and how the pilot trimmed the aircraft as reported.
RFDS Central Operations
The ATSB requested pitch trim runaway occurrence data from RFDS Central Operations (RFDSCO), as another operator of similar PC-12 aircraft. RFDSCO advised that there was no record of any verified pitch trim runaway events involving their PC-12 aircraft in the 9 years prior to the occurrence that such data had been recorded. For context, RFDSCO operate a mix of PC-12/47E NG aircraft and earlier series aircraft.
ATSB database
The ATSB conducted a search of the occurrence database for pitch trim runaway events involving the PC-12 aircraft type and a comparative aircraft type, the Beechcraft/Raytheon/Textron King Air. Apart from this occurrence, no pitch runaway events for either type were recorded in the ATSB database.
As reported in a previous section, RFDS identified six other pitch trim runaways involving their PC‑12 aircraft. These were not reported to the ATSB.
In response to a query from the ATSB, RFDS advised that the other pitch trim runaways were considered to be routine defects and handled via the incident reporting and/or maintenance reporting systems. Each of the events recorded in the incident reporting system were reviewed by the Head of Flying Operations and considered to have been handled appropriately.
The Transport Safety Regulations 2003 stipulate reporting of certain events to the ATSB. For a non-air transport operation such as RFDS, the use of any procedure for overcoming an emergency was prescribed as a routine reportable matter. The ATSB considered that a pitch trim runaway required a pilot to action the applicable emergency procedure and was therefore a routine reportable matter.
Pilatus records
At the request of the ATSB, Pilatus provided pitch trim runaway occurrence data for the PC-12 aircraft type. Pilatus recorded 56 pitch trim runaway events world-wide between 1999 and 2019. These occurred in all phases of flight and included at least 45 events involving the PC-12/47E model.
In 47 of the pitch trim runaway events, the recorded maintenance action was replacement of one or both of the manual trim relays or the (autopilot-related) trim adapter unit. None of the recorded maintenance actions were applicable to the alternate stabiliser trim circuit.
The amount of detail in the event descriptions varied and some did not provide information about pilot actions. For 10 events, there was recorded alternate stab trim use by the pilot and for three events, the pilot reported having insufficient time to action the emergency procedure before landing. In one event, the pilot tried to use the alternate stab trim but it did not operate.
Where pilot action was reported, it was common for the Trim Interrupt switch to be selected with associated stopping of the pitch trim runaway. There were no reports of pilot mis-selecting the Flap Interrupt switch instead of the Trim Interrupt switch.
Instructions for Continuing Airworthiness – Pilatus
As the aircraft manufacturer and type certificate holder, Pilatus produced specifications and instructions for continued airworthiness of the PC-12 aircraft type. Those instructions included periodic functional checks of the pitch trim system and procedures for troubleshooting and component replacement. Up to the month before the occurrence, there were no specific maintenance requirements for the manual trim system relays or trim adapter unit. As such, the relays remained in service ‘on‑condition’ until a defect was detected.
In March 2019, Pilatus issued Service Bulletin SB 27-024 to provide for replacement of the trim adapter unit that used electro-mechanical relays (auto pitch trim) with a unit that uses solid-state relays. At the time of the occurrence, Pilatus had prepared Service Bulletin SB 27-023 to provide for replacement of the two electro-mechanical relays in the manual pitch trim system with one solid-state relay. This was not issued until March 2020 due to limited parts availability.
Pilatus advised that the two Service Bulletins were developed to address a known reliability issue with the electro-mechanical relays. Due to frequent switching at their load limits, the relay contacts had a decreased operational life of approximately 25,000 cycles.
Examination of PC-12 pitch trim system relays
The electro-mechanical relays used in the PC-12 pitch trim system were a two-pole, double-throw design. Each pole consisted of a common terminal that was switched between a normally open contact and a normally closed contact. For this installation, only one pole was utilised.
Defective relay removed from VH-OWJ
The ATSB examined the manual pitch trim DOWN relay (identification number K161E2) removed from VH-OWJ to characterise the failure mode and assess the implications for continuing airworthiness. A visual inspection of the relay did not identify any anomalies (Figure 7). The markings were consistent with the specifications.
To record the internal configuration of the relay, the ATSB arranged for an x-ray before the relay was altered (Figure 8). This showed that for both poles of the relay, the normally open contacts were closed and the normally closed contacts were open. Electrical continuity checks of the pins were consistent with that anomalous configuration.
The ATSB detached the casing from the base of the relay to examine the internal mechanism (Figure 9). A visual inspection of the mechanism confirmed the anomalous configuration of the contacts and revealed the failure type for the normally open contacts.
For the relay pole connected to the pitch trim circuit (active), the normally open contact was melted and fused close. There was sooting on surfaces near the contacts and black contaminant from the black caps that covered the contacts. Beads of gold-coloured metallic material was observed on surfaces near the contacts. As a result of the fused contact, the other contacts were fixed in anomalous positions.
The relay manufacturer advised the ATSB that the condition of the contacts was consistent with a significant high-energy event that occurred while the relay was energised. The melting and welding of the contacts without circuit breaker activation is indicative of a short-duration high-current event such as a lightning strike. It was not possible for the manufacturer to determine the root cause of the relay failure.
Figure 7: External condition of defective relay
Source: ATSB
Figure 8: X-ray of defective relay showing anomalous configuration of the contacts (circled).
Source: ATSB
Figure 9: Opposite end views of relay mechanism showing the two sets of anomalous contact conditions
Source: ATSB
Other relay removed from VH-OWJ
The ATSB obtained and examined the manual pitch trim UP relay (identification number K161D2) from VH-OWJ. This relay was installed in the aircraft at the time of the occurrence and was functioning normally at the time of removal.
A visual inspection of the relay did not identify any anomalies and the markings were consistent with the specifications. The ATSB detached the casing from the base of the relay to examine the internal mechanism.
The active normally-closed contacts showed a localised build-up of metallic material on one contact surface (pimple-shaped) with corresponding loss of material from the other surface. This was consistent with electrical arcing.
Defective relay from other PC-12
The ATSB obtained and examined the manual pitch trim DOWN relay (identification number K161E2) from the RFDS aircraft that sustained a trim runaway on 3 August 2019 (Table 1, item 7).
A visual inspection of the relays did not identify any anomalies and the markings were consistent with the specifications. The ATSB detached the casing from the base of the relay to examine the internal mechanism.
The internal condition of the relay was similar to the defective relay from VH-OWJ. The active normally-open contact was melted and fused close. There was sooting on surfaces near the contacts and beads of gold-coloured metallic material was observed on surfaces near the contacts. As a result of the fused contact, the other contacts were fixed in anomalous positions.
The active normally-closed contacts showed localised material transfer that was similar to that observed to contacts in the manual pitch trim UP relay from VH-OWJ.
PC-12 Pitch trim defect reports
The ATSB provided details of the relay examination and analysis to CASA. They conducted a search of the CASA Defect Reporting Service (DRS) database for reports of defects in the PC-12 autopilot and flight control systems. This identified a number of reports including one report of a faulty pitch trim adapter (to a non-RFDS aircraft). No reports of manual pitch trim relay defects were identified.
For aircraft maintained under the Civil Aviation Regulations, it was a requirement that major defects be reported to CASA immediately. This included defects that caused, or that could cause, a control system failure. The list of examples published by CASA included serious malfunction of flight controls without specifying any types.
CASA uses defect reports as a means of identifying trends in design and maintenance reliability for the benefit of aviation safety. Reports are collected by CASA and maintained in a database. It is of benefit to both CASA and the aviation industry that the database contains accurate and relevant information. From this database, information may be:
obtained to provide reliability statistics and trend monitoring of aircraft, engines, propellers, systems and components - CASA shares this information with other regulatory authorities
used as a basis for development or review of an Airworthiness Directive (AD)
used for the development of other advisory publications, such as Airworthiness Bulletins
used for other appropriate regulatory purposes.
RFDS advised that no defect reports were submitted to CASA in relation to the malfunctions that resulted in pitch trim runaway events. This practice was based on the definition of a major defect as that which affects the safety of an aircraft or cause the aircraft to become a danger to persons or property. As there were secondary systems to manage a pitch trim runaway, RFDS did not consider the associated malfunctions to be major defects.
The ATSB was unable to establish if relay malfunction with pitch trim runaway was classified as a major defect as described in the Civil Aviation Regulations. Nevertheless, operators are encouraged to submit reports of PC-12 pitch trim defects to the DRS to facilitate CASA monitoring of continuing airworthiness data. __________
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2019-019
Occurrence date
14/04/2019
Location
4 km west of Merredin
State
Western Australia
Report release date
13/05/2020
Report status
Final
Investigation level
Defined
Investigation type
Occurrence Investigation
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Loss of control
Occurrence class
Serious Incident
Highest injury level
None
Aircraft details
Manufacturer
Pilatus Aircraft Ltd
Model
PC-12/47E
Registration
VH-OWJ
Serial number
1411
Aircraft operator
Royal Flying Doctor Service of Australia (Western Operations)
At 2000 Central Standard Time on 13 May 2018, the crew of a Leonardo Helicopters AW139, registered VH-YHF, departed Darwin, Northern Territory, to search for an active emergency position-indicating radio beacon (EPIRB). The crew flew under night visual flight rules with support of a night vision imaging system.
During an approach to a potential EPIRB target, smoke from nearby bushfires affected visibility and the helicopter developed an uncommanded high rate of descent. The Aircrew Officer, in the rear of the helicopter, called ‘Climb! Climb! Climb!’, and the pilot regained control with a rehearsed recovery drill. During the recovery procedure, the power demand exceeded airframe limitations. This exceedance went undetected, and the helicopter was flown on a second sortie that same evening.
What the ATSB found
The pilot entered instrument meteorological conditions during approach, and lost control of vertical speed. The helicopter descended to 31 ft above ground level during the event. Reversion to standard patter and practiced drills allowed the crew to recover the situation and avert an accident.
Two layers of protection available to the crew of the helicopter were not used. Flight instruments were not referred to in the incident approach, and a crewmember trained to support the pilot in monitoring the approach was required to be in the rear of the aircraft.
A main gearbox over-torque of 159.5 per cent occurred during the recovery. The crew could not determine the magnitude of the potential over-torque after the event. Subsequently the aircraft remained in service in a condition of uncertain airworthiness.
What has been done as a result
CareFlight has established three main controls aiming to prevent reoccurrence:
Stabilised Approach Criteria was written into standard operating procedures, requiring an immediate go-around if the aircraft leaves a prescribed range of approach parameters.
Controlled flight into terrain (CFIT) avoidance training was incorporated into the ground-based training syllabus.
Improved advice on use of auto hover functions was written into aircraft handling standard operating procedures. This included a requirement that the function was not to be engaged while the helicopter was descending.
Safety message
Pilots must be aware of the human factors hazards associated with loss of visual references. Pilots can protect themselves by maintaining the use of instrument scans in approaches at night, and making use of monitoring by trained and available crewmembers.
Flight planning should include assessment of the risk of a degraded visual environment. Operators should document their minimum acceptable levels of illumination and levels of tolerable risk. Where the risk exists, predetermined responses should be readily available.
Instrument flight rules (IFR) pilots in IFR-rated aircraft should prioritise use of inadvertent instrument meteorological conditions drills and pre-planned exit routes over recovery of visual meteorological conditions.
Flight crew and engineering teams should not rely solely on indicators, or absence of indicators, to determine airworthiness. If there is any reason to suspect exceedance of aircraft limits, operators should run diagnostics to determine the airworthiness of the aircraft beyond doubt.
People have a responsibility to aid their own rescue. Up-to-date registration of an EPRIB, and correct use of an EBIRB and other signalling equipment, simplifies a rescue of people in need. Australian Maritime Safety Authority guidelines exist to help people prepare for onshore and offshore remote area travel.
Safety analysis
Introduction
During an approach to a potential search and rescue target, smoke from nearby bushfires affected the visibility for the flight crew. The helicopter developed an uncommanded high rate of descent, and the aircrew officer in the rear alerted the pilot, at which point a recovery was enacted. The recovery manoeuvre resulted in an airframe limitation exceedance, which went undetected for the subsequent flight.
This analysis will examine the operator’s risk management, degraded visual environments, single pilot operations, and airframe limitation exceedance management.
Operator’s risk controls
On this occasion, prevention controls failed and recovery controls worked to save the aircraft and crew. There were, however, gaps in the implementation of all of the documented controls:
Training and checking achieved the aim of creating relevant experience, yet an identified limited practice opportunity reduced efficacy.
Crew resource management (CRM) lapsed in a missed announcement of loss of visual references. CRM was, however, restored to good effect in recovery.
The aircrew officer (ACO) was trained yet not positioned to assist the pilot in managing the approach.
There were no preventative controls that helped crews to define limits of visibility beyond the description of visual flight rules (VFR) minima.
The operations manual stated:
Illumination levels are significantly affected by moon position and strength, cloud presence, and cultural lighting and during NVG operations; illumination levels have a profound effect on the ability of the NVG to clearly discern terrain at distance. Visibility is also affected by the usual day time issues of dust, snow, moisture, bushfire smoke and other atmospheric obscurants.
However, the operations manual offered no guidelines on interpretation of factors affecting visibility or definition of acceptable limits. This meant the crew had to interpret marginal conditions during operations and decide if the minima were sufficient. This meant that the organisation did not set its own tolerance for risk in this regard.
During the event, CRM, the well-rehearsed recovery drill, and use of the attitude indicator were all vital in recovering control of the aircraft. The documented and implemented recovery controls worked as intended.
Contribution of night vision imaging system
Studies have shown that night vision goggles’ (NVG) performance can lead pilots to revert to a daytime model of operation (Rash, 2010), leading them to overlook the threats and complexities of operating with NVG. The operator’s operations manual clearly reminded crew that NVG does not turn night into day, and that the use of NVG carries limitations and risk.
Low-contrast Terrain
The search area was an area of low-contrast terrain for night vision imaging systems (NVIS) operations. This meant that elements of the terrain reflected similar amounts of celestial light, creating a low-quality image in the NVG. This lack of detail reduced visual cues. The reduction in visual cues most likely led to difficulty in perceiving the aircraft’s attitude and estimation of terrain clearance (Parush et al., 2011).
Obscurants
Airborne particles affect the image that NVG produce. The cues that would normally be relied upon for loss of visual meteorological conditions (VMC)[14] may not be present. Operating unaided, light sources begin to disappear as obscurants increase. Under NVG, as obscurants reduce the light energy reaching the goggles, NVG will continue to amplify the light signal, disguising the worsening visibility (see CAAP 174-01 11). There will be steady reduction in image quality outside of the bright spots as signal to noise ratio reduces. Scintillation[15] in the image will occur.
Sighting pinpoints of bright light over long distances does not mean that visibility is in excess of 5 km. Visibility must be measured by the distance detail can be seen on the ground. If a pilot using NVG can see lights but no ground detail, they may be in or very close to instrument meteorological conditions (IMC).[16] An early decision to use a recovery drill if visual references are lost is also vital to ensure entry into IMC does not develop into a loss of control or controlled flight into terrain.
Degraded visual environment
Conditions of degrading visibility create ambiguity. This ambiguity can stall decision-making, as two contextually different situations are faced (Orasanu and others, 2001). Either the approach continues and the target is assessed, or the approach is aborted and the mission is delayed.
Pilots rely on appropriate visual cues to assess quickly and accurately the aircraft’s current and future situation. Darkness, even while utilising a NVIS, reduces availability of these cues. No one is immune to these phenomena and strict adherence to an instrument scan on night approach is the primary protection available.
Pilots tend to underestimate the likelihood of loss of control and overestimate their ability to continue to control the aircraft if visual references are lost (Wiggins and others, 2012). The cues for IMC are an absence of those for VMC. The search area for cues to resolve the ambiguity is external to the aircraft, and as such, attention can be drawn outside (Summerfield & Egner, 2009).
Humans also often incorrectly believe that changes will be easy to detect in their environment. Unless someone observes a change while it is taking place, there is a good chance it will not be picked up (Wickens & McCarley, 2008). While searching outside for cues, changes on instruments can be missed. These missed changes can lead a pilot to believe that their knowledge of their position and trajectory in space is accurate. This belief leads to a reduction in the search for new information or information to the contrary (Wickens & McCarley, 2008).
Above 400 ft, the approach should be predominantly made with reference to instruments (see CAAP 174-01 D.3). The pilot was primarily using goggle vision and looking outside. The narrow field of view of the NVG’s requires a demanding and deliberate scan pattern to integrate the outside with instruments. As the pilot slowed to below 45 kt with reducing visual cues, the picture outside was not giving enough information to manage the closure rate of the aircraft. This resulted in a loss of the ability to recognise, with any accuracy, the aircraft’s position and trajectory.
Single-pilot operation
Monitoring is a fundamental tool to boost threat and error management (Flight Safety Foundation, 2014). Furthermore, inadequate monitoring is related to a high number of approach and landing accidents. While there is a clear benefit to multi-crew operations, there is no requirement for multi-crew in Australian search and rescue (SAR), and emergency medical services (EMS). SAR/EMS Operators in Australia tend to perform reduced crew flight operations, whereby extra crewmembers are called upon only for periods of vulnerability.
Crew in the back of an AW139 cannot hear alarms from the cockpit. The 400 ft warning from the Radio Altimeter (RADALT) and the 150 ft warning from the aircraft are only available to front seat crew. The aircraft descended through 400 ft at 1,430 ft/min. The pilot resumed manual control at the time of the emergency climb call as the aircraft passed through 280 ft, 3.5 seconds later.
Had there been a second person in the cockpit monitoring the approach, their first indication of a loss of visual reference, if not announced by the pilot, would most likely be an unusual combination of attitude and vertical speed. The aircraft had developed an unusually high 900 ft/min rate of descent 12 seconds before passing through 400 ft. This information may take a monitoring Aircrew Officer (ACO) a second or two to process. Once processed, however, the aircrew officer (ACO) is in a position to call for a go-around, and to provide accurate information to the pilot regarding the aircraft state much sooner in the sequence.
While facing a high risk of encountering a degraded visual environment, the requirement to have the ACO in the rear cabin for winch operations degraded the crew’s defences against loss of control. The addition of another trained crewmember would be an ideal risk control for operations in potentially degraded visual environments.
Caution and maintenance messages
There is no option for the crew to review caution messages once the message has self‑cleared, or to interrogate the system to discover the extent of any exceedance. As the main transmission torque limit exceedance message (XMSN OVTQ) was missed because it appeared during a time of high workload in flight, the crew could not know of the nature and extent of the exceedance without the support of an aircraft maintenance engineer (engineer).
The crew and the engineer who downloaded the data the following day reported that no maintenance message was detected on the crew alert system (CAS). Analysis of the central maintenance computer (CMC) log showed that eight minutes before the incident flight, a maintenance message activated for 41 seconds. A maintenance message again illuminated four minutes after landing for 31 seconds until shutdown.
The crew reported that the maintenance message was overly generic and related to a host of issues, ranging from critical to inconsequential. The only way to determine the meaning of the message was for an engineer to access the CMC through a laptop. Given the remote locations and 24‑hour nature of operations, engineer access was often impractical, and some telephone diagnosis had to take place.
Additionally, a software update had previously caused issues by instructing the aircraft that equipment it did not have was fitted. As a result, numerous maintenance messages related to the failure of the non-existent equipment were seen. This nuisance message issue was resolved 6 months prior to the event.
These nuisance alerts and generic nature of the message could combine to dilute the significance of the maintenance message and reduce the likelihood that crews would seek out and respond to genuine alerts.
Automatic hover mode use
The autopilot’s automatic hover (HOV) mode fitted to the helicopter could be engaged while the helicopter had a high rate of descent. If this system was not explicitly understood, the pilot may believe that HOV mode had adequate control of the aircraft upon activation. It would display as engaged even though it could be subject to a considerable overshoot, outside of the system’s capacity to recover before impact with terrain. At the height engaged, the mismatch between reference height and actual radar height would have triggered a PFD message ‘HTLM’ and an aural callout of ‘ALTITUDE, ALTITUDE’ after about 2.5 s, as the aircraft passed through a point between 39 ft and 70 ft below the reference height. The pilot input came 4.2 s after engagement of automatic hover. Without the correct mental model of HOV mode operation, time taken to interpret autopilot performance may have delayed manual recovery actions.
Beacon registration and placement
When the vessel was located, the crew saw the emergency position-indicating radio beacon (EPIRB) laying in the bottom of the boat and not deployed as per Australian Maritime Safety Authority guidance. This resulted in a scattered signal and created inaccuracies in the operation of the Direction Finder (DF). The crew could not resolve the direction of the beacon.
The lack of accurate registration details and sporadic output of the DF caused distraction to the crew and increased their time to find the target. The result for the crew was that they were required to identify a number of targets and make approaches to them for visual identification. This increased the complexity and time taken to complete the operation.
Figure 7: Correct EPIRB placement following activation
Source: Australian Maritime Safety Authority __________
The pilot had over thirty-seven years’ experience in flying helicopters. He held an Airline Transport Pilot Licence (Helicopter) and instrument rating (Helicopter), authorising him to conduct night visual flight rules[9] (NVFR) and instrument flight rules[10] (IFR) operations as pilot. The pilot had gained experience around the world in military helicopter operations, onshore and offshore resource support, mountain flying, search and rescue, and ambulance helicopter operations. He held a current Class 1 Aviation Medical Certificate.
Table 1: Pilot’s rotary-wing hours accumulated
Total Time Rotary Wing
9,800
Instrument Flight
327.5
Night Flight
833.0
AW139
724.9
Source: Pilot
The pilot had more than 100 hours’ experience in command with night vision imaging systems (NVIS) and held a grade 1 NVIS rating. The operator’s training and checking system evaluated the pilot as level 2 night vision goggles (NVG).
The pilot achieved currency with an NVIS proficiency check on 9 May 2018. Notes on file advised the pilot to seek practice opportunities in order to consolidate skills for future upgrade to a level 1 NVG pilot. The report also noted that a lack of opportunity to practice was preventing the pilot from making best use of the aircraft’s automated systems.
The pilot’s roster pattern was week-on, week-off, performing 24-hour standby while rostered on. The most recent pattern started on 09 May 2018. In the 4 days prior to the incident, the pilot had accumulated 27.3 hours of duty and 5.8 hours of flight time. Within the Operator’s Fatigue Risk Management System[11] (FRMS), scores of 75 or less were considered consistent with safe working practices. The pilot’s score was 51. He reported feeling well and alert.
Aircrew Officer
The Aircrew Officer (ACO) had 23 years’ experience in crewing Search and Rescue (SAR) and Emergency Medical Services (EMS) helicopters as winch operator and down the wire rescue crewmember. He also held a Commercial Pilot Licence (Helicopter). His total experience in crewing helicopters was over 3,500 hours.
The ACO was NVIS and winch current, having undergone currency and proficiency flights on 10 and 12 May 2018. The Operator’s AW139 crewmembers all completed a pilot’s ground school course for the AW139. The ACO was trained and competent in front seat support and rear cabin activities. The ACO was rated as a Level 1 NVG crewmember within the operator’s system. He had over ten years’ NVIS experience, and he was part of a team that first integrated NVIS into company operations.
The ACO worked on a week-on, week-off, 24-hour standby roster. The ACO reported feeling well and rested at the time of the incident. The ACO’s score of 32 in the Operator’s FRMS supported this.
Flight Nurse
The Flight Nurse (FN) was a medical crewmember responsible for patient care, and not expected to be involved in the operation of the aircraft in flight.
Flight crew configuration
Exemption to operate with crewmember in rear cabin
The Civil Aviation Safety Authority (CASA) provided the Operator with an exemption to Supplement 60 of the AW139 rotorcraft flight manual. The exemption allowed the ACO to operate from the rear cabin of the aircraft during flight below 300ft and for landing at unimproved sites.
The Operator provided a risk analysis for landing at unprepared helicopter landing sites (HLS) under NVG to CASA in support of the exemption. For the descent and final approach phases, the identified risks were concerned with unintentional interference from the ground, obstacles, and loose objects. The helicopter manufacturer had no technical objection to the exemption on the provision that, amongst other things, the crewmember focussed on ensuring identification of obstacles.
Focussing on flight below 300 ft, the risk analysis provided for the initial exemption did not consider risks in the approach phase of flight relating to monitoring and the need for a single pilot to transition from outside goggle vision to instruments to supported peripheral vision. This exemption was later rendered unnecessary by an amendment to Supplement 60 in revision 22 of the AW139 rotorcraft flight manual on 19 October 2017. The manufacturer stated that they addressed risks during transition phase in the initial NVIS certification of the aircraft.
Climb-through
The Operator listed the responsibilities of an ACO in their operations manual as:
Under direction of the pilot assist with the operation of all aircraft equipment and systems during the conduct of VFR, NVG and IFR operations;
and
… operate the winch, dispatch, and recovery of personnel and assist the pilot in maintaining clearance from obstacles by lookout and reporting over the intercom.
Company ACOs could not carry out all of their duties from one location in the aircraft. The ACO had to climb between the front and back as operational requirements demanded. CASA’s position was that they supported the role of the ACO in the front left seat and did not support the transfer of the ACO from the front to rear of the cabin and vice versa in flight. CASA preferred operators to land for the ACO transfer through the aircraft to take place.
When responding to an emergency, the ACO would ordinarily begin the flight in the front and assist the pilot, then climb through to the rear to operate the winch as required. When an ACO used the climb-through, the company required the crew to file a report for data collection and analysis of the procedure.
On this flight, with no available landing sites on scene, and a short flight to the search area with anticipated use of the winch, the ACO began the flight in the back of the helicopter.
Aircraft information
General
Leonardo Helicopter’s AW139 is a medium-sized twin-engine helicopter powered by two Pratt & Whitney PT6C-67C engines (Figure 3). Each engine is capable of producing take-off power of 1,252 kW. Each engine produces enough power for the aircraft to climb in the event of one of the engines failing. The main gearbox’s maximum limit for power from both engines is 1,641 kW. Therefore, overtorque of the transmission can occur when a pilot demands excessive engine power with both engines operative.
VH-YHF
AW139 serial number 31108 was registered in Australia on 18 February 2008 as VH-YHF, and at the time of the occurrence had flown 3,423 hours. The helicopter was certified and maintained for IFR and NVIS operations.
The helicopter’s autopilot was a 4-axis system with enhanced 3-cue flight director (FD). The FD is capable of controlling the helicopter’s movement in the pitch, roll, yaw, and vertical axis. The installed version of the FD had auto-hover functionality (HOV) mode, yet did not offer SAR modes that can mark, return, and transition down to a selected target.
Figure 3: AW139 helicopter VH-YHF
Source: Careflight
Auto-hover
HOV mode incorporates two systems to hold the aircraft at a point in space selected by the pilot. The first system controls the pitch and roll of the aircraft to maintain a zero ground speed in all directions. The second uses the barometric altitude or the radio altimeter[12] (RADALT) information and control of height to maintain the altitude selected by the pilot.
Aside from the panel-mounted autopilot controller, the pilot can activate both systems with the centre of the pitch/roll beep trim selector switch on the cyclic (Figure 4). With the airspeed below 75 kt, ground speed below 60 kt and altitude between 15 ft and 2,000 ft above ground level the system can be engaged. Engaging the system instructs the autopilot to make control inputs to bring the aircraft to a hover at the height showing on the RADALT at the time the pilot presses the switch. There was no vertical speed limit to engage HOV mode. The manufacturer did not intend for HOV mode to be engaged with a high vertical speed, though it did not preclude a pilot from doing so.
If engaged with a high vertical speed, the system would show as engaged and the autopilot would make adjustments necessary to attain the height designated by the pilot. This would induce a magnitude of overshoot relative to the vertical speed at time of engagement. A difference between the reference height and actual height would trigger a warning once large enough. For example, at a reference height of 500 ft, a message ‘HTLM’ appears on the PFD and ‘ALTITUDE, ALTITUDE’ sounds when the actual height passes below 430 ft.
Source: Leonardo Helicopters, annotated by the ATSB
Crew Alert System
The primary flight display (PFD) and the multi-function flight display (MFD) present instrumentation to the pilot (Figure 5). The PFD displays FD modes selected, and their status. The MFD displays engine and aircraft system data and the crew alert system (CAS). The CAS displays messages pertaining to the operation and condition of the aircraft to the crew for information and action.
Figure 5: Exemplar AW139 cockpit displays
Source: Leonardo Helicopters file photo, annotated by the ATSB
The CAS messages appear in order of priority. Red warnings appear at the top of the list, next are yellow caution messages, third are green advisory messages, and fourth are white status messages. The final line in the list is white text stating ‘END.’ Each page shows twelve lines and crew can scroll through pages. When scrolling, red warnings cannot be hidden and remain at the top of the list on each page.
A warning or caution message will show with a coloured background until acknowledged. Once acknowledged, it appears as coloured text on a black background. Some messages such as “XMSN OVTQ” (main transmission overtorque) will disappear when the condition causing them has passed. White status messages will only show on the ground with weight on wheels (Figure 6).
The “MAINTENANCE” message is significant because following exceedance of a limit such as torque, it will illuminate after landing. The presence of the “MAINTENANCE” message is a cue to an aircraft maintenance engineer (engineer) to investigate and rectify the cause of the message before cancelling the message.
Figure 6: Exemplar caution light and maintenance message on CAS
Source: Leonardo Helicopters, annotated by the ATSB.
Night vision imaging system
To improve vision during night operations, the helicopter crew utilised an NVIS. The operator was experienced in application of these technologies. They trained their own crews and offered NVIS training to other operators.
The operator’s NVIS comprises:
AN/AVS-9 green phosphor Night Vision Goggles (NVG)
NVG-compatible cockpit lighting
NVG-compatible cabin lighting
2 x 450 W incandescent forward facing steerable search lights
1 x 450 W incandescent steerable search light by winch
White flood lights at the front and back of the aircraft.
The operator mandated the use of NVIS for all visual flight rules (VFR) flights at night.
Goggle position
The human eye carries two sets of light-sensitive receptors: rods and cones. The cones are packed into the fovea, the central part of the retina responsible for focal vision. The rods populate the area of the retina used for peripheral vision. The way in which information from the focal regions and information from the peripheral regions is processed differs significantly (Miller & Tredici, 1992).
Peripheral vision is processed automatically and quickly. Humans utilise peripheral information to orientate themselves within their environment without even noticing. Focal vision requires conscious processing, which happens slowly and takes up cognitive resources (RTCA, 2001). The information delivered to the user through NVG is largely within the focal region. The cognitive resources required take away from other tasks requiring focal vision, such as interpretation of instruments (Salazar et al, 2003).
NVG offer a field of view (FOV) of 40° vertically and horizontally, much narrower than the 200° horizontally and 120° vertically most humans experience (Morawiec and others, 2007). Goggles are normally adjusted to a point where the central image is sharp, and the edge of the picture is slightly blurred yet becomes sharp when focussed upon. This puts the eyepiece approximately 25 mm from the eye.
This operator advised that they extend the NVG further away from the eye again. This reduces the FOV by a couple of degrees and increases the amount of peripheral vision available. This, in combination with copious white light, provides for increased peripheral vision when looking around the goggles below 400 ft in the obstacle environment.
This provides benefit in spatial orientation in low-level hover operations. The effect will be lost if peripheral cues become unreliable and obscure the target, such as happens with backscatter from obscurants like smoke.
White light
The use of white light is fundamental to this operator’s NVIS usage strategy. NVG-friendly[13] searchlights do not help in obstacle clearance as the NVG do not detect the light reflected by obstacles in the vicinity. White light (detectable by NVG) is amplified by the goggles and provides a clear image of where obstacles are. The crew moves the lights in a ‘scan and pause’ pattern with a wide swath either side of the planned approach and departure paths looking for obstacles.
The combination of peripheral vision and white light likely aided the ACO in his assessment of rate of closure and enabled his timely use of emergency phase Crew Resource Management (CRM).
NVIS approach procedure
Overhead the HLS or point of interest, the pilot marks the target on the GPS. The pilot then flies a circuit at 1,000 ft to set up an approach to the spot. Since the visual acuity afforded by the goggles does not provide ground cover detail until a height of 400 ft, the pilot must use instruments to monitor the progress of the aircraft, as per normal night flight procedures. The company operations manual highlights three critical instruments for the initial stage of the approach:
attitude indicator, to avoid incorrect attitude adversely affecting airspeed and rate of descent
vertical speed indicator, to make up for the reduced visual cues for rate of descent
radio altimeter, to incorporate a visual and audible warning that is set at 400 ft as a defence against unexpected rates of terrain closure
The pilot manually flies to a datum point of 400 ft above ground level (AGL) to attain the visual acuity required to identify the target. It is common to come to a hover at 400 ft to complete the reconnaissance and crew brief. The pilot can select HOV mode to pause. If there is a need to descend to winching height, the crew scans the approach and departure paths with searchlights using a ‘stop, scan, move’ process.
Once clear, the crew agrees to continue and the pilot eases the aircraft forward and down with the autopilot. ACO and pilot will work together to bring the aircraft to the best hover reference.
Meteorological information
During the shift, the pilot monitored weather reports and weather forecasts from sources at Darwin and surrounding airports, and the Bureau of Meteorology (BoM). The Aerodrome Forecast (TAF) for Darwin airport, valid for the duration of the flight, forecast wind as 6 kt from the south‑east, visibility of 10 km or greater, nil significant weather, and nil significant cloud below 5,000 ft. The aerodrome report matched the forecast precisely with the exception of showing wind to be 5 kt.
The BoM issued a Graphical Area Forecast (GAF) at 1332 Central Standard Time (CST), which carried a validity from 2030 CST for six hours. The planned operation was within area B2, and the operations were close to the boundary with B1. The GAF forecast scattered cloud with base 2,000 ft and tops to 10,000 ft in the area of B1. The forecast for the area B2 was visibility over 10 km reducing to 5,000 m with isolated areas of smoke below 7,000 ft. The crew reported that some of the conditions associated with B1 existed in their area of operation.
At 1923 CST, BoM published a new GAF. The new GAF showed visibility of 10 km reducing to 4,000 m with isolated areas of smoke below 7,000 ft in B2. Pilots utilising NVG must maintain visibility of 5,000 m at or above 500 ft above terrain or obstacles (Civil Aviation Order 82.6). In areas of smoke, visibility could be expected to be below that required for VFR flight at night.
Environmental conditions
On the night of the incident, there was very little celestial illumination. The moon had set at 1653 CST, and the sun had set at 1830 CST. The only light was starlight. Clouds obscured much of the starlight available.
Grass fires had been burning to the southeast of the region for several days. Smoke from the outlying grass fires drifted across the search area below 7,000 ft, reducing visibility in places. The operations manual mentioned smoke as a common cause of loss of visual reference, and pilots were required to memorise loss of visual reference drills.
The crew reported that these conditions had prevailed for a week. Training notes from a flight three days prior described similar conditions. The report stated:
…this flight was conducted on an especially difficult NT typical night – no moon, very low illumination, and smoke contamination.
Where operationally viable, the crew flew the helicopter above the smoke inversion, which they reported to be at around 1,000 ft.
Risk management of deteriorating weather and loss of visual references
The operator’s risk management profile recognised the risk of deteriorating weather and loss of visual references during a SAR operation. Among the potential consequences was loss of control leading to an aircraft accident. The management of the risk included controls for prevention of an occurrence, and for recovery should the event occur.
Prevention controls
Documented controls for the prevention of loss of visual references were:
Training and checking, to ensure that crews have relevant experience of similar conditions, all crew know how to assist in the approach and landing phase, and that procedures are being correctly followed.
Maintenance of good CRM, to ensure effective mission management and decision making aboard the aircraft.
Keeping the ACO current to assist the pilot with management of the flight.
Recovery controls
Recovery controls covered four aspects of operation:
Equipment fit, ensuring that the aircraft is appropriately equipped and has a functioning RADALT and Attitude Indicator.
Sound knowledge of procedures and limits for visual illusions and inadvertent instrument meteorological conditions (IIMC).
Crew preparedness: Use of simulator training to ensure crews have exposure to implementing correct technique in recovery procedures.
Crew Resource Management: Ensuring unambiguous and timely communication in situations requiring urgent action.
Beacon activation
Activating an emergency position-indicating radio beacon (EPIRB) begins a distress signal transmission on the 406 MHz frequency, which is detected by satellites. The transmission contains a code that identifies the registered owner of the EPIRB in a database. The Rescue Coordination Centre (RCC) can use the registration details to source information on the activation of the beacon, and contact the owner or a nominated emergency contact.
In this case, the EPIRB belonged to a Queensland-registered vessel, which was sold some time before without re-registration of the EPIRB. As a result, the RCC had no current contact details or information for the current owner of the EPIRB.
EPIRBs in Australia also transmit on the 121.5 MHz frequency. Search and Rescue Assets carry direction-finding (DF) equipment to home in on 121.5 MHz signals. When the beacon is correctly deployed, the DF shows the crew the direction the signal is coming from.
On 22 July 2007, the crew of a Bell 412 were searching for the source of an EPIRB transmission. The pilot was IFR-rated and the aircraft IFR-equipped. The crew were operating on a dark night with searchlights without NVG. There was smoke from active bushfires in the area.
During the approach, the pilot lost visual references due to the haze from smoke and dust in the atmosphere. The helicopter entered a high rate of descent. The aircrew officer called ‘zero airspeed.’ The pilot initiated recovery actions and the main gearbox was over-torqued in the recovery.
There was a landing site available and the pilot continued the approach from 200 ft AGL and inspected the helicopter after landing. The Bell 412 had a physical indicator that clearly indicated to the crew that overtorque had occurred.
In December 2009, the crew of a Bell 206L was conducting aerial work on a fire ground. The pilot was not IFR-rated and helicopter was not IFR-equipped. On take-off, the helicopter entered low cloud. The pilot lost control and the aircraft collided with the ground; the pilot was seriously injured and the passenger was fatally injured. There was no option for the pilot to conduct an IIMC drill to stabilise the aircraft and attain a safe profile.
On 21 October 2016, the crew of a BK 117-C2 were returning to base from carrying out an EMS mission. The pilot was IFR-rated and the aircraft was IFR-equipped. The flight was conducted under NVFR with NVIS. Conditions were marginal, and on departure, the helicopter entered low cloud.
The ACO declared loss of visibility on take-off. The pilot had poor visibility ahead yet could see well to the right. The pilot thought visibility would improve as they passed ground lighting that was reflecting in raindrops on the canopy.
The visibility did not improve, and the pilot slowed the aircraft to maintain visual meteorological conditions. The low-speed manoeuvre resulted in an undesired aircraft state and a terrain awareness warning activated. The pilot conducted an IIMC drill, restabilised control, and continued the flight before landing safely.
Aeromedical flights in the United States
In an analysis of aeromedical flights in the US, Aherne and others (2016) found that between 1995 and 2013, the US aeromedical industry had 32 fatal accidents resulting in 100 deaths. These flights were all single-pilot operations at night. All flights were operated under VFR, and two thirds of the fatal accidents occurred in instrument meteorological conditions (IMC).
The sources of information during the investigation included:
the pilot and crew
Careflight
Aviation Specialities Unlimited
the Bureau of Meteorology
Airservices Australia
Leonardo Helicopters
the Civil Aviation Safety Authority.
References
Aherne BB and others, 2016, Pilot Domain Task Experience in Night Fatal Helicopter Emergency Medical Service Accidents, Aerospace Medicine and Human Performance. 87(6). 550-556.
Arthur W and others, 1998, Factors That Influence Skill Decay and Retention: A Quantitative Review and Analysis, Human Performance. 11(1), 57-101.
Australian Transport Safety Bureau, 2004, ASR B2004/0152, Night Vision Goggles in Civil Helicopter Operations
Bailey RE and others, 2017, An Assessment of Reduced Crew and Single Pilot Operations in Commercial Transport Aircraft Operations, 2017 IEE/AIAA 36th Digital Avionics Systems Conference, St Petersburg
Biggs AT and others, 2015, Examining perceptual and conceptual set biases in multiple-target visual search, Atten Percept Psychophys. 77. 844-855.
Civil Aviation Authority, 2013, CAP 739, Flight Data Monitoring
Dismukes RK & Berman B, 2010, Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail, National Aeronautics and Space Administration, Moffett Field
Flight Safety Foundation, 2014, A Practical Guide for Improving Flight Path Monitoring, Washington.
Flight Safety Foundation, 2018, Position Paper: Pilot training and competency, Alexandria.
Miller RE & Tredici TJ, 1992, Night Vision Manual for the Flight Surgeon, Armstrong Laboratory, AL-SR-1991-0002
Morawiec G, Niall KK & Scullion K, 2007, Distance estimation to flashes in a simulated night vision environment, Defence R&D Canada, TR 2007-143
Orasanu J & Martin L, (1998). Errors in aviation decision making: A factor in accidents and incidents. In Proceedings of the Workshop on Human Error, Safety, and Systems Development. 100-107.
Orasanu J, Martin L & Davison J, (2001). Cognitive and contextual factors in aviation accidents, in Salas E and Klein G (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.
Parush A, Gauthier M, Arseneau L & Tang D, (2011). ‘The Human Factors of Night Vision Goggles Perceptual, Cognitive, and Physical Factors’, Reviews of Human Factors and Ergonomics. 7. 238-279.
Previc FH & Ercoline WR, 2004, Spatial Disorientation in Aviation, American Institute of Aeronautics and Astronautics, Inc., Reston.
Rash CE, 2010, ‘Lighting Up the Night’, Aero Safety World. August 2010. 14-18.
Robson D, Night Flight, 2008, Aviation Theory Centre, Cheltenham.
RTCA 2001, Concept of Operations: Night vision imaging systems for civil operators, RCTA/DO-268, RTCA, Washington, D.C.
Salazar G and others, 2003, Civilian use of night vision goggles, Aviation Space and Environmental Medicine. 74. 79-84.
Summerfield C & Enger T, 2009, Expectation (and attention) in visual cognition, Trends in Cognitive Sciences. 13(9). 403-409.
Wiggins MW and others, 2012, ‘Characteristics of pilots who report deliberate versus inadvertent visual flight into instrument meteorological conditions’, Safety Science. 50(3). 472-477.
Wiggins MW and others, 2014, ‘Cue-utilisation typologies and pilots’ pre-flight and in-flight weather decision-making’, Safety Science. 65. 118-124.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF, engineers for VH-VHF, and Careflight.
Submissions were received from the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF and Careflight. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
The occurrence
Incident flight
On the evening of 13 May 2018 at 1943 Central Standard Time,[1] the Rescue Coordination Centre (RCC) tasked the crew of a Leonardo Helicopters AW139, registered VH-YHF, to locate an active emergency position-indicating radio beacon[2] (EPIRB) 38 km north-east of Darwin Airport, Northern Territory. The EPIRB had been activated within the vicinity of a waterway called Salt Water Arm (Figure 1).
Figure 1: Map showing Darwin take-off point, search area, and location of incident event
Source: Google Earth annotated by the ATSB
The area was popular with recreational anglers, so the crew of VH-YHF anticipated responding to a boating event. They also determined that such a response would likely require use of the aircraft’s winch.
The crew configured the aircraft with the pilot on night vision goggles[3] (NVG) in the front right seat, the aircrew officer (ACO) with NVG in the rear cabin by the right hand door, and the flight nurse in the rear cabin without NVG. Lighting within the cockpit and cabin was NVG-compatible. Two steerable searchlights mounted to the front, one steerable searchlight mounted to the right side of the aircraft, a handheld light operated by the ACO, and LED light bars at the front and rear of the helicopter supported the Night Vision Imaging System[4] (NVIS).
At about 2000, the crew departed Darwin Airport with good visibility. At that time, a five-metre tide was receding from Salt Water Arm. There was little illumination as the moon had set at 1653, and the sun had set at 1830. There was limited celestial light available through the gaps in the clouds which were forecast as scattered[5] cumulus and stratocumulus clouds at 2,000 ft, with cloud tops to 10,000 ft. Smoke from outlying grass fires drifted across the search area below 7,000 ft, reducing visibility to 4 km in places. The crew could not easily detect the smoke due to low illumination.
As the crew descended into the search area and commenced the search, smoke became evident as the task progressed. The ACO described visibility as 5 km but dropping in and out due to large amounts of smoke. These conditions are common for the region, and recent check flights for the crew had been conducted in similar conditions.
During the flight, the beam of the search light would reflect off smoke and ash. Backscatter from the beam was affecting visibility, reducing NVG image quality, and reducing peripheral vision. As a result, the beam required frequent adjustment. The ACO contacted the RCC and advised that limited visibility may hamper the operation.
The helicopter was fitted with direction-finding equipment (DF) which enabled the crew to locate the source of a 121.5 MHz beacon signal, such as the EPIRB. The crew found that readings from the DF were erratic and unreliable. This added a level of complexity to the operation, making it difficult to locate the beacon. As a result, the crew conducted a visual search for potential targets from a safe working height of above 800 ft above ground level (AGL).
While the use of NVG allowed the crew to detect targets, the image quality was not high enough to verify the targets from this safe working height. The crew had to fly the aircraft down to 400 ft AGL to verify whether their target was one requiring rescue. The crew flew the descent to the target visually, using searchlights to ensure the approach and departure paths were clear of obstacles. The intent was to decrease rate of descent and airspeed before activating auto-hover (HOV) mode at 400 ft AGL.
At 2110:30, the crew commenced an approach from the north to a point of interest in Salt Water Arm. The pilot reported visibility on approach to the target as good to the north-west, and dark to the north and east. During this approach, the pilot lost visual references. At 2110:40, the pilot activated HOV mode. At this time, the helicopter had already developed an undesired high rate of descent (Figure 2).
Figure 2: Flight path of VH-YHF during the event
Source: Leonardo interpretation of data from the Flight Data Recorder, annotated by ATSB
At the point of activation of HOV mode, the aircraft was at 430 ft, pitched 19.7 degrees nose-up, and descending at over 1,300 ft/min with a ground speed of 14 kt. The autopilot increased collective[6] pitch to 48 per cent to arrest the rate of descent.
Due to the lighting installed on the aircraft, and prioritisation of peripheral vision, the ACO could see the ground below and advised the pilot of a high rate of descent. The ACO provided advice twice more to the pilot before transitioning to an emergency call of ‘Climb! Climb! Climb!’ The pilot was by now receiving clear visual cues and detected a rapid rate of closure with the ground.
At 2140:46, at a height of 280 ft with a rate of descent of 1,630 ft/min, in a reversion to drilled emergency procedures, the pilot overrode aircraft automatics and used forward cyclic[7] and collective to reverse the rate of descent. The pilot directed his attention to the attitude indicator and the picture outside. The pilot increased collective pitch to 77 per cent. At this point, the rate of descent increased to 1,952 ft/min, indicative of onset of vortex ring state[8].
Maintaining forward cyclic, the pilot was aware of engine temperature limits and made a small reduction in collective to avoid exceeding the limits, before increasing collective again to 84 per cent.
At 2140:50, a yellow caution light illuminated and a crew alert system (CAS) message appeared on the display. Occupied with the recovery procedure, the pilot flew solely through the outside picture and the attitude indicator. The aircraft descended to a height of 31 ft AGL before attaining a positive rate of climb. As the pilot’s recovery manoeuvre ceased and control inputs returned to normal, the warning self-extinguished at 2140:57. The pilot noticed the warning, but could not read it before it extinguished.
It is likely that any further delay in conduct of the recovery drill would have led to an impact with terrain.
Return to base
The crew advised the RCC that they would end the flight and return to base. The crew landed the helicopter back at base at 2158. The pilot found that ash had accumulated on the fuselage of the helicopter, confirming flight through streams of smoke. During the flight through smoke, visibility was reduced below the visual minima.
A crew debrief took place and it was thought that a main gearbox overtorque could have occurred. There is no capacity in the aircraft for the crew to check for overtorque without the presence of an aircraft maintenance engineer (engineer). As a precaution, and as per Operations Manual requirements, the crew called a duty engineer to explain the situation and seek advice.
The duty engineer asked the crew to check the CAS system for messages. If an overtorque occurred, a white status message saying ‘maintenance’ would be present. This would signal a requirement to download and analyse data from the aircraft’s central maintenance computer (CMC).
The pilot estimated the extent of a potential overtorque to be within operational limits. The crew did not detect a maintenance message. With this information, the duty engineer advised that no maintenance activity was required.
Subsequent mission flight
Prior to the mission’s second flight, the crew thoroughly discussed the event. They developed a different strategy for the search to prevent reoccurrence, including the use of topography over the DF.
At 2254, the crew departed for the second flight to locate the source of the EPIRB transmission. The crew flew the arms of the river system at 1,000 ft using the autopilot, with the pilot flying with reference to instruments, and the ACO visually searching from the back.
The EPIRB was successfully located and noted to be in the bottom of a 14 ft metal-hulled recreational fishing boat. The boat carried two people and was in total darkness. As the vessel was unlit, the ACO could see the EPIRB flashing in the bottom of the boat. The position of the EPIRB had most likely resulted in the sporadic readout of the DF.
The helicopter crew directed a nearby Northern Territory Water Police vessel to the scene. The Water Police were then able to assist.
Detection of main gearbox overtorque
The following day, the crew related the experience to an engineer in the hangar and requested a download of the CMC data to check for potential issues. An overtorque of the main gearbox is recorded when a torque limit is exceeded. The limits for all engines operative are 110 per cent for five minutes, or 121 per cent for 5 seconds.
The engineer downloaded and analysed the data. An overtorque in excess of 125 per cent requires grounding of the aircraft, and analysis of the data by the engine and airframe manufacturers. He found that a main gearbox overtorque to 159.5 per cent had occurred during the first flight. The extent of the overtorque was such that the helicopter should not have been flown until the engine and airframe manufacturers declared the helicopter serviceable.
The engineer grounded the helicopter and sent data to the manufacturers of the engines and airframe for analysis. This meant that the crew had departed for their second flight of the previous evening in an aircraft of uncertain airworthiness.
Five days later, the engine manufacturer confirmed that the engines were undamaged and suitable for service. The helicopter manufacturer advised that the helicopter’s main gearbox was serviceable and required inspection of oil for metal contamination at 50 flight-hour intervals. The engineers carried out the necessary actions, and subsequently returned the helicopter to service.
From the evidence available, the following findings are made with respect to the loss of control of a Leonardo Helicopters AW139, registered VH-YHF, on 13 May 2018, and the subsequent release of the aircraft without a required inspection. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
During the search for a transmitting beacon, the helicopter crew planned to approach to a hover near a target. However, low celestial illumination and drifting smoke created a high risk of encountering a degraded visual environment. This resulted in a loss of visual references on approach.
During the approach to hover in a degraded visual environment, searching outside for visual cues drew the pilot’s attention away from the flight instruments. This resulted in flight instruments not being referenced when they were needed.
The required position of the aircrew officer in the rear of the helicopter prior to descent negated the benefit of having a trained and competent crewmember to assist the pilot, resulting in a degraded monitoring capability in the approach to hover.
While on approach in a degraded visual environment, without the protections of flight instrument use or monitoring, the helicopter entered an uncommanded, undetected high rate of descent, resulting in a transmission overtorque during recovery.
Other factors that increased risk
Auto hover had no design limit on vertical speed for engagement, which permitted overshoot following engagement with high rate of descent.
As the aircrew could not confirm the existence of an exceedance, and a maintenance message was not detected on the Crew Alert System, the aircraft was operated despite requiring an inspection.
Other findings
Application of good Crew Resource Management and practiced recovery techniques supported the crew in restoring control.
The emergency position-indicating radio beacon was not registered to the current owner, and was incorrectly placed in the boat. The placement scattered the beacon's signal, leading to loss of accuracy in direction-finding equipment. As a result, mission complexity and time taken to rescue were increased.
Appendix A: Flight data
Figure 8: Incident flight data
Source: Operator / Leonardo Helicopters, annotated by the ATSB
Figure 9: Incident flight data
Source: Operator / Leonardo Helicopters, annotated by the ATSB
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 15 May 2018, at 1903 Eastern Standard Time,[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.
The pilot had a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement.[2] The pilot performed a pre-flight inspection of the aircraft in a hangar under lights and then moved the aircraft out of the hangar onto the apron. After the instructor arrived, a pre-flight briefing was held in the hangar, which included the effects of the night environment on depth perception and the procedural differences from daytime flying.
The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display. The aircraft was taxied for a departure from runway 11 and the pilot activated the runway lighting while taxiing. In addition to the runway lighting, precision approach path indicator (PAPI) lighting was also available.[3]
One touch-and-go[4] circuit was completed to runway 11 without incident. On the second circuit, when at about 500 ft above ground level on approach to land, the pilot noted the PAPI was displaying four-white lights. In response, the pilot steepened the approach and then observed two‑white and two-red lights. When the runway surface came into view in the aircraft landing lights, the pilot flared for the landing. The aircraft bounced and the pilot elected to apply full power and go-around, rather than attempt to continue with the landing.
When full power was applied, with full flap selected, the aircraft pitched up. As the pilot was transitioning his scan onto the instruments, the instructor repeatedly directed him to maintain wings level. The pilot felt the aircraft was rolling to the left and the runway lights appeared to the right.[5] Shortly after, the aircraft collided with the ground and came to rest inverted (Figure 1).
Figure 1: Cirrus SR22 registered VH-PDC wreckage
Source: ATSB
The pilot exited the aircraft after kicking out a window, at which stage the wings were alight and a grass fire had started. He then assisted the instructor with exiting. While moving the instructor clear, the pilot heard a canister discharge from inside the wreckage and about 1 minute later he heard what sounded like the aircraft parachute pyrotechnic activate.[6] Emergency services located at the airport immediately responded to the accident.
Closed-circuit television footage
Closed-circuit television footage from Orange Airport showed the aircraft rolling left at a low height above runway 11 and impact the ground on the north-east side of runway 11 at 1903. A fire ensued about 5 seconds after impact and about 9 minutes after impact a pyrotechnic device activated.
Ongoing investigation
The investigation is continuing and will include the following:
interviews with the pilot, instructor and any witnesses (preliminary interview with pilot completed and a preliminary statement has been provided by the instructor)
examination of aircraft recorded data
examination of the aircraft flight controls.
_________ The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this preliminary report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 15 May 2018, at 1903 Eastern Standard Time, a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.
What the ATSB found
The ATSB found that the pilot, who was conducting his first night training flight, likely became spatially disorientated during a go-around manoeuvre, which resulted in a loss of control at low level and collision with terrain.
The flight instructor did not intervene to take control of the aircraft during the go-around manoeuvre, because she was not aware the pilot had become spatially disorientated and was accustomed to directing the pilot to correct control problems. Inconsistent with Civil Aviation Safety Authority guidance, the instructor, who had previously instructed the pilot for his private instrument rating, did not provide a night flying demonstration before directing the pilot around the circuit.
Safety message
It is important for flight instructors to provide a demonstration when introducing a pilot to a new flight sequence or new flight environment. Time spent demonstrating the key points of a new sequence or environment will usually improve the learning process by ensuring that the development of a new skill is supported and preceded by knowledge and understanding from experience.
The flight instructor reported that for the delivery of future initial night flying training, she would conduct either a separate session of daytime flying training circuits prior to night, or deliver the training as day-into-night circuit training. She also commented that, prior to teaching night flying, flying training organisations should consider conducting refresher training in unusual attitude recoveries, irrespective of a pilot’s level of experience and qualifications.
General details
Flight Instructor details
Licence details:
Commercial Pilot Licence (Aeroplane), issued 11 February 2015
260.1 hours at last maintenance release issued 2 July 2017
Type of operation:
Flying training – training dual
Persons on board:
Crew – 2
Passengers – nil
Injuries:
Crew – 2 (serious)
Passengers – nil
Damage:
Destroyed
Findings
From the evidence available, the following findings are made with respect to the spatial disorientation and collision with terrain involving Cirrus SR22, registered VH-PDC, at Orange Airport, New South Wales, on 15 May 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While attempting a go-around manoeuvre from an aborted touch-and-go, the pilot did not immediately transition his scan onto the attitude indicator and became spatially disorientated, which resulted in loss of control of the aircraft and collision with terrain.
The flight instructor was not aware the pilot had become spatially disorientated, which resulted in her providing direction rather than intervention during the loss of control.
Other factors that increased risk
Contrary to best practice, the flight instructor elected to direct the pilot for his first night flight without a demonstration. This decision was influenced by the pilots' experience, private instrument rating, and previous instructional method.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Cirrus Aircraft
Civil Aviation Safety Authority
flight instructor
Orange City Council
pilot
United States National Transportation Safety Board.
Gibb R, Ercoline B & Scharff L 2011, ‘Spatial disorientation: decades of pilot fatalities’, Aviation, space, and environmental medicine, vol. 82, no. 7.
Newman DG 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Canberra. Aviation research and analysis report – B2007/0063.
Shea C, Wright D, Wulf G & Whitacre C 2000, ‘Physical and observational practice afford unique learning opportunities’, Journal of motor behavior, vol. 32, pp. 27–36
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Cirrus Aircraft, Civil Aviation Safety Authority, flight instructor, pilot and United States National Transportation Safety Board.
The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Context
Pilot information
The flight instructor held a valid Commercial Pilot Licence (Aeroplane), a Grade 1 flight instructor rating, an instrument rating and a night visual flight rules rating. She had a total flying experience of about 4,200 hours and last completed a flight review on 3 December 2017.
The pilot held a valid Private Pilot Licence (Aeroplane) and a private instrument flight rules rating. He last completed a flight review on 11 March 2017 (private instrument rating), had accrued about 500 hours on Cirrus aircraft, and about 50 hours of instrument flight time. The pilot had conducted the majority of his training and subsequent flying from Orange Airport, where his aircraft had been hangered.
Closed-circuit television footage
Closed-circuit television footage from Orange Airport depicted the aircraft rolling left at a low height above runway 11 before impacting the ground on the north-east side of the runway at 1903. A small fire ensued after impact, followed by deflagration of the fuel vapour about 7 seconds later. About 9 minutes later, the CAPS[13] rocket fired. Figures 2, 3 and 4 depict the initial roll of the aircraft, deflagration of the aircraft fuel vapour and firing of the CAPS rocket.
Figure 2: VH-PDC in left roll
Source: Orange City Council, annotated by the ATSB
Figure 3: Deflagration of fuel vapour
Source: Orange City Council
Figure 4: CAPS rocket
Source: Orange City Council, annotated by the ATSB
Aircraft information
Electronic stability and protection
Before take-off, the pilot checked the aircraft’s autopilot and then switched it off. When the autopilot is switched off, the aircraft’s electronic stability and protection (ESP) system is operational. The ESP system automatically activates the autopilot servos to recover the aircraft from excessive roll and pitch attitudes.
The ESP roll protection activates at 45° roll angle, reaches a maximum stick force at 50°, and disengages when the roll angle reduces to 30°. The ESP pitch protection engages at 17.5° nose up, reaches a maximum stick force at 22.5° and disengages at 12.5°. Although the ESP uses the autopilot servos to drive the controls, the pilot retains the ability to override the system.
Recorded data
VH-PDC carried a Garmin G1000 avionics package, and a Recoverable Data Module (RDM). The G1000 is capable of recording various parameters to a secure digital (SD) card, installed on the upper slot of the MFD. The same information is recorded to the RDM, which is an impact and fire resistant unit,[14] installed on the vertical fin spar. The RDM and MFD modules were removed from the aircraft for examination by the ATSB.
The RDM was recovered from the severely fire damaged fin. The rear portion of the module was exposed to a high temperature and showed external heat damage. Disassembly of the crash hardened enclosure to access the data storage components revealed extensive fire damage to the memory devices. No data was recovered from this device.
Initial observations of the MFD SD card slots revealed they were substantially fire damaged and retained two SD cards; the top slot contained the data logging card, the bottom slot contained the Garmin database card. To access the cards, the MFD was disassembled, and the circuit board holding the two cards was removed. The data logging card was found to be substantially damaged (Figure 5). The encapsulated memory device was removed from the data logging card and cleaned. The data logs were then extracted with a modified SD card reader. A total of 241 flight logs were recovered, including the accident flight (Figure 6).
Figure 5: Data logging SD card
Left: Removed MFD slot with data logging SD card. Right: removed data logging card with card memory identified. Source: ATSB
Figure 6: Recovered accident flight data
Source: ATSB
The recovered flight data indicated that after touchdown, power was initially increased to about 45 per cent (19:02:15) and a slight left roll initiated. Power was then advanced to about 90 per cent (19:02:18) and the left roll developed to a peak value of -52° (19:02:23) with a pitch attitude of +20° (nose-up)[15] and airspeed varying from 56–69 kt.[16] The pitch attitude then increased to a peak value of +29° before lowering to +7° as the aircraft rolled right to a peak value of +27° at a height of about 100 ft above the runway (19:02:25).
The aircraft collided with the ground followed by the airport boundary fence and came to rest inverted during the period 19:02:26–30.[17] The final track at initial impact was about 60° left of the runway centreline. During the accident sequence, the rate of heading change to the left developed commensurate with the angle of left roll, and the recorded normal and lateral G‑accelerations[18] were minimal.[19]
Wreckage information
With the exception of the right rudder cable, no mechanical defect was found that could have prevented the normal operation of the aircraft. The right rudder cable was found attached to the rudder, but the forward end was found with a failure near the connection to the rudder pedals. The cable was removed from the wreckage for examination by the ATSB. A preliminary examination determined it did not fail from fatigue. The aircraft’s flight data demonstrated the rudder was operational during the accident sequence. On that basis, it was concluded that the rudder failure observed was a result of the impact, and no further examinations were conducted on the rudder cable assembly.
Survival factors
The aircraft was fitted with a composite roll cage within the fuselage structure to provide roll protection for the occupants. The front seats were each fitted with a four-point inflatable restraint system with an inertia reel lock. Despite coming to rest inverted after striking the ground at about 60–70 kt, the pilot and instructor reported that they found themselves uninjured, but could not open the doors with the aircraft inverted.[20] The inflatable restraints (air bag style system) did not activate, but this was considered likely to be due to the gradual level of deceleration.
The iBrace Survivor Questionnaire[21] was completed for the pilot and instructor with the following results:
The pilot was able to evacuate unassisted from the aircraft while it was filling with smoke by kicking out a window. He then pulled the instructor out of the burning wreckage after seeing her collapsed inside. He suffered from third-degree burns to 7 per cent of his body.
The instructor was unable to evacuate unassisted from the aircraft after she became disorientated in the dark, smoke filled environment, which led to a loss of consciousness. She suffered from first and second-degree burns and smoke inhalation injuries, which required her to be intubated.
Closed-circuit television footage identified an ambulance crossing the runway towards the accident site about 3 minutes after impact. In addition, an emergency medical service helicopter was located at the airport with the crew on duty at the time of the accident. They transported the pilot and instructor to Sydney for treatment.
Additional information
Spatial disorientation
The pilot reported that the aircraft pitched up when he applied power for the go-around and that he observed the runway lights disappear off to the right. He felt that the aircraft was in a roll while he was trying to focus his eyes on the attitude indicator as the instructor was directing him to level the wings. He commented that without enough right rudder the aircraft will ‘pull to the left’ [when applying additional power] and that it is normal to apply right rudder, but that ‘it was pitch black’.
There is a small village, Spring Hill, located upwind of runway 11, but the instructor reported that it was not large enough to produce an illuminated horizon below about 200 ft above ground level. She reported that on the night of the accident, at low level with the runway lights obscured, it was ‘pitch black’, and that [for a pilot looking outside] the environment would have been ‘totally disorientating’.[22]
Benson (1988; as cited in Gibb et al., 2011) defined spatial disorientation as:
The pilot fails to sense correctly the position, motion, or attitude of his [or her] aircraft or of himself [or herself] within the fixed coordinate system provided by the surface of the earth and the gravitational vertical.
The three sensory systems for determining orientation of the human body in space are the visual, vestibular,[23] and somatosensory[24] systems. Newman (2007) and others have reported that the visual system provides 80 per cent of the orientation information in normal conditions. However, in the absence of visual cues, orientation and motion information are divided between the vestibular and somatosensory systems. These systems can easily produce false information for a pilot due to local accelerations of the aircraft about the pitch, roll and yaw axes.
The vestibular system responds to head position and movement, which may lead to an incorrect perception of body motion if not supported by a visual reference. For example, an upward pitch (head backward) may be detected as a forward acceleration, and a roll as a lateral (sideways) acceleration. The somatosensory system detects local accelerations on the body, but if the pitching and rolling motions occur at close to +1G flight, such as during the accident sequence, the somatosensory system may not be able to resolve ambiguities generated by the vestibular system.
It was noted by Newman (2007) and Gibb et al. (2011) that spatial disorientation is likely an under‑reported phenomena in aviation. They suggested that this may be due to it resulting in one of two likely outcomes; either the pilot recovers the aircraft with no harm or damage done, and therefore does not perceive the need to report; or it results in a fatal accident and the investigation cannot verify from the evidence available that spatial disorientation contributed to the event.
Flight instruction
Instrument flying proficiency
The Civil Aviation Safety Authority’s (2007) Flight Instructor Manual: Aeroplane, chapter 18: Night Flying, states the following:
Before students undertake night solo circuit operations they must have received sufficient instrument flight training to enable them [to] carry out the following manoeuvres solely by reference to instruments: a) climb and climbing turns, b) straight and level flight and level turns, c) descent and descending turns, d) unusual attitude recovery full panel.
As the pilot already held a private instrument rating, the above training exercises were not required to be conducted as lead-in to his night flying training.
Demonstration
The Flight Instructor Manual stated that ‘airborne sequences must follow an acceptable method of teaching like: demonstrate, direct then monitor. However, the pilot acted as flying pilot for his first night flying training flight without a prior demonstration.[25] The instructor explained that there were several reasons for this as follows:
When the pilot first approached the instructor for his private instrument rating training, he was already a qualified pilot [private pilot licence] who owned his own aircraft and was capable of flying it competently. The instructor considered him an advanced student for the instrument training as he had already accumulated several hundred flying hours experience.
The instructor used the direct method to deliver the pilot’s instrument training. This was about 40 hours of dedicated instrument flying training.
At the time of the accident flight, the instructor and pilot had accumulated about 50 hours flying together without the need for the instructor to demonstrate a flying sequence or intervene to correct an improperly flown sequence. The pilot’s instrument flying training ensured he had accumulated sufficient minimum instrument flying prior to his first night flying training flight.
Benefit of demonstration
The benefit of demonstration as an instructional technique is that it permits the student to focus their attentional resources on key learning points for new sequences, without the diversion of those resources to managing the flight path. Studies have noted that observational experience, in addition to physical practice, can provide a more effective learning experience than physical practice alone.
In 2000, Shea et al. compared the performance of a physical practice group with a combined observation and physical practice group on a motor learning test. The physical practice group outperformed the combined practice group under the practice test conditions, but when the test conditions were varied from the practice conditions, the combined practice group ‘performed significantly better’ than the physical practice group.
Intervention
After the go-around was commenced, the instructor reported that the aircraft entered an unusual attitude. Both the instructor and pilot reported that the instructor was repeatedly directing the pilot to level the wings. The instructor commented that at the time, she was thinking ‘get that left wing up’, but directing ‘wings level’. At the time, her eyes were focused on the pilot’s attitude indicator[26] and she was expecting the pilot to recover the aircraft. However, the pilot had become spatially disorientated, which she was not aware of. It was only a matter of seconds between the instructor’s comprehension that the aircraft was not responding and the impact with the ground. The instructor considered that it ‘happened very fast’, and that as she was not in the habit of taking over the controls from the pilot, her natural reaction was to direct what was needed. The pilot also reported that it ‘happened very quickly’, with ‘no height to recover’.
The Cirrus SR22 is fitted with two single-handed side control yokes mounted beneath the instrument panel on the left and right side of the cockpit, and the instructor reported that it is not an easy aircraft for an instructor to take over control from a student. She commented that the single-handed yokes are sensitive in their response, which can lead to ‘fighting over the controls’ if the instructor attempts to follow-through on the controls[27] while a student is flying. Therefore, she was not following through on the controls during the touch-and-go sequence.
Previous similar accidents
Spatial disorientation
Spatial disorientation presents a danger to pilots as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control. Gibb and others (2010) state that spatial disorientation accidents have a fatality rate of about 90 per cent, indicating how compelling the misperceptions can be. A search of contributing safety factors in the ATSB aviation occurrence database revealed that of the investigated accidents where spatial disorientation was found to be a factor (about one per year), nearly all resulted in fatal injuries.
The United States National Transportation Safety Board’s database was searched for previous accidents involving spatial disorientation. A search of all aircraft categories returned 710 results. Cirrus SR20 and SR22 aircraft returned 18 results for spatial disorientation as a finding between 2003 and 2017, 13 of which were fatal accidents (four of the non-fatal accidents involved use of the Cirrus Airframe Parachute System for recovery). The conditions for all of the accidents were instrument meteorological or night, or combination of both. Of the 18 accidents for Cirrus aircraft, 10 were for instrument-rated pilots and four occurred during take-off.
The ATSB education booklet Avoidable Accidents No. 7, Visual flight at night accidents: What you can’t see can still hurt you (AR-2012-122) outlines a number of night-time accidents that have been a result of spatial disorientation due to dark night conditions.
Loss of control during go-around
A search of the ATSB database for previous SR22 accidents involving a loss of control during a go-around manoeuvre found one result of interest:[28]
During a touch-and-go training exercise, the aircraft veered off the runway to the left while under full power for take-off. The pilot reported that his attention may have been diverted to the flap control lever at the time (ATSB reference number 201006782).
The United States National Transportation Safety Board’s database was searched for previous similar accidents. The search criteria were Cirrus SR22, instructional flight, and accident. The search results were then filtered for loss of control events during an attempted go-around. The following results of interest were reviewed:
Report ERA12FA540: Loss of control in-flight. ‘During the final approach, witnesses saw the airplane drifting to the left while descending at a relatively high sink rate. Witnesses heard the power being adjusted, and, close to the ground, the engine went to high power. The airplane’s nose rose, and the airplane veered to the left. The airplane touched down left wing down off the runway in grass, heading about 40 degrees left of the runway centreline. It then entered woods, where it hit numerous trees and came to rest upside down and on fire…Examination of the wreckage revealed no pre-existing mechanical anomalies that would have precluded normal operation’.
Report ERA13CA222: Landing area overshoot. ‘According to the instructor, he and the student pilot were practicing short field landings. When the airplane was about 20 feet above the ground on approach to the runway, the airspeed suddenly decreased. The student pilot applied full engine power, the airplane yawed to the left, and the airplane impacted the ground before it reached the runway. The flight instructor reported no pre-impact mechanical malfunctions or failures with the airplane that would have precluded normal operation’.
Report NYC07CA010. ‘As the pilot of the SR-22 was performing a flare for landing, the airplane’s airspeed “became too slow,” and the pilot applied full power and announced “go-around.” The airplane veered left, and continued approximately 100 yards, before it struck a tree and came to rest upright. The pilot reported no mechanical anomalies with the airplane’.
Safety factor: an event or condition that increases safety risk. In other words, it is something that, if it occurred in the future, would increase the likelihood of an occurrence, and/or the severity of the adverse consequences associated with an occurrence. Safety factors include the occurrence events (e.g. engine failure, signal passed at danger, grounding), individual actions (e.g. errors and violations), local conditions, current risk controls and organisational influences.
Contributing factor: a safety factor that, had it not occurred or existed at the time of an occurrence, then either: (a) the occurrence would probably not have occurred; or (b) the adverse consequences associated with the occurrence would probably not have occurred or have been as serious, or (c) another contributing factor would probably not have occurred or existed.
Other factors that increased risk: a safety factor identified during an occurrence investigation, which did not meet the definition of contributing factor but was still considered to be important to communicate in an investigation report in the interests of improved transport safety.
Other findings: any finding, other than that associated with safety factors, considered important to include in an investigation report. Such findings may resolve ambiguity or controversy, describe possible scenarios or safety factors when firm safety factor findings were not able to be made, or note events or conditions which ‘saved the day’ or played an important role in reducing the risk associated with an occurrence.
Safety issue: a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operational environment at a specific point in time.
Safety action: the steps taken or proposed to be taken by a person, organisation or agency in response to a safety issue.
Safety analysis
Introduction
During a night training flight, a go-around from runway 11 at Orange Airport, New South Wales was commenced. Shortly after, the Cirrus SR22 aircraft, registered VH-PDC, collided with the ground. The flight instructor and pilot received serious injuries and the aircraft was destroyed.
As mentioned above, the presence of a fractured rudder cable in the wreckage was not considered a contributing factor. This was because the rate of heading change during the accident sequence followed the angle of roll, rather than the application of power, and there was no significant lateral acceleration associated with the application of power.
The data logging card did not record pilot control inputs or movement of the autopilot servos. Therefore, it could not be determined if the reversal of the initial rolling and pitching motion was the result of the actions of the pilot, or flight instructor, or the aircraft’s electronic stability and protection system. However, the thresholds for activation of the aircraft’s pitch and roll protection were reached during the accident sequence, and the reversal of the pitch and roll were consistent with the operation of the system. While the system was designed to mitigate an unusual attitude from developing, the act of recovering from a high pitch angle at slow speed will inevitably result in a loss of height.
The final approach on the accident flight was steep at 500 ft. While this was corrected before the landing, it would have increased the pilot’s workload during the approach. Using this as a trigger to conduct a go‑around would have provided the pilot with the opportunity to set up for a more stable approach on the next circuit.
This analysis will examine the conduct of flight demonstrations, and the pilot experiencing spatial disorientation and the flight instructor’s awareness of such.
Flight demonstration
The pilot was undergoing his first night flying training flight for the addition of a night endorsement to his private instrument rating. The flight instructor had previously instructed the pilot for his instrument rating, and considered him an advanced student. His instrument flying training was delivered by the instructor using the instructional method of direct, without the need to demonstrate any sequence or intervene to correct an incorrectly flown sequence. Because of this earlier experience, the instructor elected to use the instructional method of direct without first demonstrating any of the key learning points for the night flying environment.
Night circuits involve a unique runway environment for assessing the approach path and landing, and require a unique procedure for combining visual and instrument flying sequences. The Civil Aviation Safety Authority’s flight instructor manual emphasised that the ‘acceptable delivery rate of new information to the student [pilot] needs to be combined with good demonstrations and adequate student practice’. Consistent with this guidance, best practice is to ensure that the student [pilot] is introduced to a new environment in a gradual way. The lack of demonstration for the pilot’s introduction to night flying likely increased the risk of the pilot not having an adequate opportunity to attend to, and absorb, the key learning points before attempting to practice the sequences as the pilot flying.
Spatial disorientation
The flight instructor reported that the pilot’s first night circuit was flown to a reasonable standard with the pilot responding to her direction. At the end of the second circuit, the aircraft bounced twice during the attempted touchdown and the pilot applied full power to perform a go-around. In response to the application of full power, the aircraft pitched nose-up and started to roll to the left. The pilot reported that he lost all external visual references as the runway lighting disappeared from view underneath the aircraft, and was attempting to focus his attention on the attitude indicator as the aircraft continued to pitch up and roll left.
The pitching and rolling motion of the aircraft, in addition to the pilot and instructor reports that the external environment was ‘pitch black’, were all consistent with the pilot experiencing spatial disorientation. The nose up pitching motion and left rolling motion were consistent with the natural response of the aircraft without corrective pilot control input.
Flight instructor awareness
During the accident sequence, the flight instructor repeatedly directed the pilot ‘wings level’, but her attention was focused on the primary flight display and she was not aware the pilot had become spatially disorientated. Therefore, she did not immediately intervene to recover control of the aircraft during the accident sequence, which only lasted about 7 seconds from the decision to go-around to initial impact.
The occurrence
On 15 May 2018, at 1903 Eastern Standard Time,[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.
The pilot held a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement to be added to his rating.[2] The instructor arrived at the hangar in the evening, just as the pilot was completing his pre-flight inspection of the aircraft. They completed the inspection together and then the instructor delivered a night flying brief to the pilot. The briefing included the physiological effects of the night environment, procedural differences for the night circuit, and the instrument and visual sections of the night circuit, which included the need to transition onto instruments on rotation during take-off.
The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display (MFD). The wind appeared to be light and variable and they selected runway 11 for the circuits. The pilot activated the runway lighting while taxiing,[3] which also provided precision approach path indicator (PAPI) lighting.[4]
The instructor directed[5] the pilot throughout the first touch-and-go[6] circuit to runway 11, which she considered was flown to a good standard with the pilot responding to her direction. On the second circuit, at about 500 ft above ground level on approach to land, the pilot and instructor noted the approach was too steep. The pilot, with direction from the instructor, corrected the approach and they both observed two‑white and two-red PAPI lights on short final approach, which indicated they were on the correct approach path. The pilot flared the aircraft a ‘little high’ for the touchdown, and the aircraft bounced twice. The pilot elected to go-around and applied full power before touching down again.
When full power was applied, the aircraft pitched[7] up. As the pilot was attempting to transition his scan onto the instruments, the instructor, whose attention was on the attitude indicator,[8] directed him repeatedly to level the wings—‘wings level’. The pilot observed the runway lights disappear off to the right and felt the aircraft was in a roll[9] as he was trying to focus his attention on the attitude indicator.[10] Following a review of the ATSB’s draft investigation report, the pilot also reported that he manipulated the flight controls in an attempt to recover the aircraft. Shortly after, the aircraft collided with the ground, struck a fence and came to rest inverted.
The pilot reported that he ‘kicked the pilot’s door window out’ to exit the aircraft, at which stage the wings were alight and a grass fire had started.[11] He then pulled the instructor out of the wreckage, who had lost consciousness after becoming disorientated while looking for the emergency egress hammer.[12] Emergency services located at the airport immediately responded to the accident. Figure 1 shows the wreckage site with reference to runway 11. Weather conditions were not considered a contributing factor to the accident.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
At about 1635 Eastern Daylight‑saving Time[1] on 7 November 2017, a Eurocopter AS350BA (AS350) helicopter, registered VH-BAA, departed Hobart Airport, Tasmania for a local training area to the northeast. On board were a pilot and instructor and the flight was the third training flight of an AS350 helicopter-type endorsement for the pilot.
The endorsement training was conducted over a two-day period. It included ground school training, and three flights that formed the practical component of the training syllabus. One instructor had assessed the first two flights but, since the third focussed on emergency procedure training, the occurrence instructor elected to fly with the pilot.
The pilot held a Commercial Pilot (Helicopter) Licence and a valid Class 1 Aviation Medical Certificate. The pilot had experience flying other turbine helicopter types, on various types of operations. The pilot’s existing low-level and sling approvals, which were reportedly held on a foreign licence, were also to be assessed during the AS350 type endorsement.
Following arrival in the training area, the pilot’s general helicopter handling and low-level flight were assessed. At about 1715, the pilots reported to air traffic control that operations in the training area were complete and requested a clearance back into the Hobart Airport control zone, to conduct practice emergencies. The approach to the airport reportedly involved conducting a simulated hydraulic system failure to the helicopter training area X-Ray (Figure 1).
Training Area X-Ray was located adjacent to and west of the main runway and was familiar to the pilot, as this area was used in the previous day’s training.
Figure 1: Approximate flight path of the helicopter (not to scale), showing the approach to the X-Ray training area, where the helicopter slowed before making an abrupt left turn and impacting terrain.
Source: Airservices Australia, modified by ATSB
The instructor reportedly announced the simulated failure to the pilot just prior to commencing the approach. The pilot responded to the simulated failure by stabilising the helicopter and reducing the airspeed to about 60 kt, in accordance with the manufacturer’s hydraulic failure procedure detailed in the aircraft’s flight manual.
The flight manual emphasised that, without hydraulic assistance, the flight controls exhibited force feedback requiring the pilot to exert additional force on the controls to maintain 60 kt in level flight. The manual also stated that, after transitioning to the recommended safety speed range, the second phase of the hydraulic failure procedure was to transition to slow run‑on landing[2] (at around 10 kt) via a flat final approach in to the wind. The pilot reported that, as the helicopter decelerated and descended towards the landing area, they noted the additional control forces required.
A video camera installed at the airport recorded footage of the helicopter’s final approach. As the helicopter descended toward training area X-Ray, it initially appeared to be controlled and in a flatter than normal approach profile. The helicopter then appeared to slow into a high hover about 30 ft above the ground. Seconds later, it commenced an abrupt nose-down turn to the left and impacted the ground.
The training procedure section of the helicopter flight manual cautioned pilots to:
…not attempt to carry out hover flight or any low speed manoeuvre without hydraulic pressure assistance. The intensity and direction of the control feedback forces will change rapidly. This will result in excessive pilot workload, poor aircraft control, and possible loss of control.
The impact forces caused significant damage to the cockpit area, particularly the left pilot side (Figure 2).
Figure 2: Damage to the helicopter showing significant impact damage to the cockpit area and left landing skid tip, consistent with a left nose-down attitude on impact.
Source: ATSB
Seated on the left side, the instructor sustained fatal injuries, while the pilot seated on the right was seriously injured.
The investigation is continuing, and will analyse the evidence obtained during the on-site investigation phase. Additional work will include a review of the:
conduct of training operations
helicopter systems
any environmental influences that may have affected the operation of the helicopter at the time of the accident.
__________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 November 2017, a chief flying instructor (CFI) and pilot under instruction (PUI) were flying a Eurocopter AS350BA Squirrel, registered VH-BAA. They were conducting practice emergencies under visual flight rules at Hobart Airport, Tasmania. During hydraulic system failure practice, control of the helicopter was lost and the aircraft collided with terrain. The CFI was fatally injured and the PUI was seriously injured.
What the ATSB found
Flight manual emergency procedures stipulate that in order to maintain control following a hydraulic system failure (or simulated failure), a shallow approach should be made into wind and the helicopter should not enter a hover. On this occasion, the aircraft approached crosswind and came to a high hover without hydraulic assistance. Consequently, the helicopter was rendered uncontrollable. A delay in restoration of the hydraulic system prevented the crew from regaining control before collision with terrain.
The ATSB also identified that:
An intermittent fault in the hydraulic cut-off switch may have delayed restoration of flight control hydraulic pressure.
A pre‑flight brief was not conducted between the CFI and PUI which may have led to confusion over aircraft control and delayed restoration of the hydraulic system.
Due to a lack of available information, the influence, if any, of these two factors on the accident sequence could not be determined.
What's been done as a result
Following this accident, the operator:
employed a trained and regulator-approved safety manager
updated the training school operations manual with stricter controls on performing AS350 sequences as per the flight manual requirements
installed an electronic system for tracking competencies and currencies.
The operator has also separated key roles of chief executive officer, chief flight instructor and the head of flight operations, which were previously conducted solely by the chief flight instructor.
Safety message
Compliance with the AS350 flight manual requirements following a real or simulated hydraulic failure ensures that the helicopter remains controllable during all phases of flight.
As this, and many other similar accidents illustrate, hovering an AS350 without hydraulic assistance can lead to a rapid, catastrophic loss of control even for highly experienced pilots. The Royal Australian Air Force found in evaluation of the AS350, while hovering without hydraulics, that the AS350 is subject to random perturbations, and reduction in control authority. Additionally the AS350 flight manual notes that without hydraulics the helicopter is subject to rapid changes in control direction and force.
In a training context, the rapid development of this accident, reinforces the need for a clear understanding and coordination between instructor and student when conducting hazardous activities such as simulated system failures.
The occurrence
What happened
On 6 November 2017, a commercial helicopter pilot commenced a 2‑day AS350 helicopter endorsement as a pilot under instruction (PUI). The first day was spent with an instructor covering aircraft systems, and pre‑flight inspection. The PUI and instructor also conducted a 1.1-hour flight that afternoon covering the initial flying components of the endorsement.
On 7 November 2017, the PUI studied the aircraft’s electrical system, and theory on handling of in-flight emergencies, including hydraulic system emergencies, with the same instructor. Following the classroom session, the PUI conducted an inspection of the aircraft under the supervision of the instructor.
Flight records showed that at 1002 Eastern Daylight‑saving Time,[1] the PUI and instructor commenced a training flight of 1.2 hours covering pinnacle approaches and confined areas, followed by run-on landings.[2] The PUI’s next planned flight was with the chief flying instructor (CFI) at 1500 for the conduct of emergency sequences. The CFI was unable to depart at the pre‑arranged time as he was attending to business matters. The PUI reported that he also took the opportunity to catch up on his own business needs during the delay. The actual takeoff was delayed by 1 hour and 22 minutes.
The instructor advised the ATSB that, prior to the accident flight, the CFI conducted a brief handover with him to ascertain the standard of the PUI’s flying and the sequences briefed. At the aircraft, the PUI explained his requirement for a low-level approval and type endorsement with the CFI however, no pre‑flight brief was conducted.
The PUI and CFI boarded the aircraft and began the flight at 1622. Pre-flight checks included testing of the hydraulic system and switches with no apparent faults identified. The PUI recalled that following the low-level phase of the training flight, the CFI demonstrated some upper air emergencies and had the PUI perform them. After satisfactory completion, they flew back to Hobart Airport for a continuation of practice emergencies.
The PUI recalled that upon joining the circuit at left base for approach to area X-Ray parallel to runway 12 (Figure 1),[3] the CFI announced a simulated hydraulic failure and activated the hydraulic test (HYD TEST) switch. As expected, a warning light and horn sounded. The PUI slowed from 90 kt to below 60 kt, consistent with the flight manual profile for hydraulic failure (see the sections titled Hydraulic failure training and Hydraulic system). The PUI then activated the hydraulic cut-off (HYD CUTOFF) switch. Following that, it is highly likely that the HYD TEST switch was released, though it is not known specifically when that occurred.
The PUI was to fly a run-on landing at around 10 kt without hydraulic assistance as per the requirements of the flight manual procedure. The PUI said he was comfortable to do so knowing the CFI was there to step in if anything were to go wrong. The PUI had very little further recollection, beyond the initiation of the event.
Table 1 and Figure 1 show the progression of the helicopter through the accident sequence. Paths, angles and rates are inferred from CCTV footage, air traffic control (ATC) data, and airport photographs. Due to limitations in the data available, these are approximate values only.
Table 1: Accident sequence from CCTV
#
Seconds
Aircraft behaviour
1
0
Heading about 120°. VH-BAA enters frame. Travelling around 20 kt.
2
12
Variations in pitch and yaw as VH-BAA slows to about 11 kt. Approach flattens, helicopter begins to yaw left.
3
18
Change of heading to about 040° after yaw to left. Comes to hover in tail wind, slowly drifting.
4
21
The aircraft climbs, pitches forward, crossing the runway, and continues to yaw left to a heading of about 300°. Yaw continues, aircraft turns left and pitches further forward to about 50° with left roll developing. Accelerates to over 20 kt ground speed.
5
28
Heading about 240°. Slides outwards in left turn. Pitch down now around 45°, roll around 50°.
6
30
Heading about 120°. Pitch down about 40°, roll increases to about 80°, helicopter impacts terrain.
Figure 1: Approximate path of VH-BAA
Source: Hobart Airport, annotated by the ATSB
At the end of the observed flightpath, the front left side of the cabin impacted the ground first. The CFI, seated on the left, was fatally injured, and the PUI in the right seat was seriously injured. The helicopter was destroyed.
The chief flight instructor (CFI) had 30 years of experience flying helicopters and had accumulated 14,200 hours of aeronautical experience. His time on type for the AS350 was over 1,000 hours. He held an Air Transport Pilot License (Helicopter) and an authority to examine pilots for issuance of licences and endorsements. He had accumulated 45.3 hours flight in the previous 28 days.
The CFI was medically fit, qualified for the flight, and had demonstrated proficiency through flight checks in:
Flight instruction on 3 August 2017
Single Engine Helicopters on 30 June 2016
Low level flight on 31 March 2016.
Instructor
The instructor was an experienced helicopter pilot with 4,000 hours’ total aeronautical experience and 1,000 hours of AS350 experience. He had previously flown with the pilot under instruction (PUI) while working for a different operator. The PUI sought out this instructor to conduct his endorsement.
Pilot under instruction
The PUI was a commercial helicopter pilot with over 1,200 hours of rotary wing experience and he was medically fit for the flight. The PUI was also managing director of a local helicopter company. The endorsement was associated with the company’s introduction of AS350 helicopters to their fleet.
Organisational and management information
The operator had been in business for 26 years and established in Tasmania at Hobart International Airport for 17 years. They specialised in charter, aerial work, and flight training operations.
The CFI was also the owner of the business, head of flight operations, chief executive officer, and undertook operational flying.
Flight endorsement training
General information
The Civil Aviation Safety Authority, through Civil Aviation Advisory Publication 5.14‑2(0) Flight Instructor Training (Aeroplane), established the need for two briefings prior to flight: a classroom brief and a pre-flight brief. These two forms of briefing prepare students for learning and performing complex sequences. A long brief in the classroom links theoretical knowledge of emergencies to practical application of those principals in the aircraft. The pre-flight brief establishes procedures and management of the aircraft between the crew. This format was not applied for the accident flight. The first instructor conducted the classroom brief, but there was no pre-flight brief between the CFI and PUI.
Hydraulic failure training
Training for loss of hydraulics in the AS350 required adherence to instructions in two rotorcraft flight manual (RFM) sections: Supplement 7 for the training procedure itself, and Section 3 for emergency procedures for management of the aircraft without hydraulics.
Supplement 7 training procedure
Supplement 7 of the AS350 RFM was incorporated in 2003; it carried specific instructions for hydraulic failure training. The sequence was divided into two distinct phases, and the hydraulic cut-off (HYD CUTOFF) switch and hydraulic test (HYD TEST) switch would not be engaged at the same time. This prevented depletion of tail rotor hydraulic pressure accumulators (not fitted in VH‑BAA) and ensured only one switch would be required to restore hydraulics at any time. Figure 2 illustrates the two phases of the procedure.
Figure 2: AS350 Rotorcraft flight manual hydraulic failure training procedure
Source: ATSB. Flow chart derived from AS350 Rotorcraft Flight Manual
Incorrect sequence taught during endorsement
The instructor and the PUI advised that the flight school taught a different version of the hydraulic failure training procedure during the endorsement and used it during the accident flight.
The procedure used had the student activate the HYD CUTOFF switch before the HYD TEST switch was released. This was a commonly‑used procedure before the release of Supplement 7. An investigation into a similar accident in Canada (A13Q0021) related that flight instructors found this sequence accurately simulated a hydraulic failure. Figure 3 illustrates the procedure.
Figure 3: Hydraulic failure training procedure as taught
Source: ATSB. Flow chart derived from accounts of procedure used by flight school
VH-BAA was not fitted with a yaw load compensator. Using this procedure on an AS350 equipped with a yaw load compensator will cause total loss of tail rotor control hydraulic assistance.
Section 3 hydraulic failure emergency procedure
For completion of the transition to landing referred to in phase 2, the hydraulic failure emergency procedure from Section 3 of the RFM was to be applied. It stated:
Keep the aircraft to a more or less level attitude. Avoid abrupt manoeuvres.
The RFM also carried the following caution:
DO NOT ATTEMPT TO CARRY OUT HOVER FLIGHT OR ANY LOW SPEED MANEUVER. THE INTENSITY AND DIRECTION OF THE CONTROL FEEDBACK FORCES WILL CHANGE RAPIDLY. THIS WILL RESULT IN EXCESSIVE PILOT WORKLOAD. POOR AIRCRAFT CONTROL. AND POSSBILE LOSS OF CONTROL.
RFM Instructions for approach and landing were:
Over a clear and flat area, make a flat final approach, nose into wind.
Perform a no-hover/slow run-on landing around 10 knots.
Do not hover or taxi without hydraulic pressure assistance.
Helicopter details
General information
The Eurocopter AS350BA,[4] was manufactured in France in 1987 (serial number 2015). It was first registered in Australia on 4 April 2000 and at the time of the accident, had accumulated 5,612 hours total time in service. It was previously registered as VH-RLU and the registration mark was changed to VH-BAA by its current owner on 20 March 2007.
VH-BAA had seating for a pilot and five passengers and was certified for day and night charter operations under the night visual flight rules. The helicopter was powered by one Turbomeca Arriel 1B turboshaft engine.
A review of Maintenance Release entries for maintenance due, showed that a 6-month inspection was required on 7 October 2017, with an over-run tolerance of 60 hours or 18 days. With the tolerance applied, the maintenance would fall due on 25 October 2017. The maintenance related to periodic greasing of the main rotor blade retaining pins.
At the time of the accident, the maintenance had not been certified on the maintenance release as complete and was overdue. No record was found in the aircraft logbook that the maintenance had been completed. While it is a pilot responsibility to ensure that a flight does not commence unless all maintenance has been completed, it is highly unlikely that the non-lubrication of the main rotor blade pins contributed to the accident.
The operator reported that VH-BAA was on temporary hire for the purposes of the endorsement training. Between 5 November and 7 November, the helicopter was operated for about 2.5 hours in the training role. Neither the initial instructor nor the PUI reported problems with the performance of the helicopter or its operation.
Hydraulic system
The aircraft was equipped with a single hydraulic system, energised by a belt-driven hydraulic pump. The hydraulic pump was regulated to provide a constant pressure of 40 bar to four flight control servo actuators. A red warning light will light at hydraulic system pressures of less than 30 bar.
There were three Dunlop servo actuators for control of the main rotor and one Dunlop servo actuator for control of the tail rotor (Figure 4). With hydraulics operating, the input force required to move the rotor blades, at the cyclic,[5] is less than or equal to 0.3 kgf. For that cyclic input, at 40 bar, the system provides an output of 183.5 kgf.
Because the aircraft exhibits increasing control loads without hydraulics at high speed, and control may be lost without hydraulics in the hover, back-up accumulators are available in the hydraulic system. These accumulators store hydraulic pressure and deliver it to the servo actuators in the event of a hydraulic failure. The accumulators carry enough stored pressure for the pilot to establish the aircraft at the safety speed from cruise or from a high hover to a landing. A safety speed of 40-60 kt was stipulated in the emergency procedures section of the rotorcraft flight manual (RFM).
Figure 4: AS350 servo locations
Source: Airbus Helicopters
A yaw load compensator was fitted to later iterations of the aircraft in order to overcome excessive forces in yaw control in the absence of hydraulic assistance. VH-BAA was not fitted with a yaw load compensator and did not have an accumulator on the yaw control. In the AS350BA, in the absence of hydraulic assistance, yaw control loads are felt directly and immediately.
Hydraulic system switches
The hydraulic system is managed via two switches. The guarded, console-mounted push-button HYD TEST switch, and the recessed, collective-mounted[6] HYD CUTOFF switch (Figure 5).
The HYD TEST switch exists to test the accumulators for the main rotor servo actuators before flight. The HYD TEST switch is OFF (out) in normal operation. Pressing the HYD TEST switch to TEST (in) creates a bypass in the hydraulic distribution block, routing pressurised fluid from the pump directly to the reservoir. This leaves the back-up accumulators to supply pressure to the main rotor servo actuators.
The HYD CUTOFF switch is ON (out) in normal operation. Pressing the HYD CUTOFF switch OFF (in) bypasses the servos by connecting the pressure inlet and return outlet in each one. The effect is to depressurise the servos and the back-up accumulators of the main rotor servo actuators. It is used in the event of an in‑flight emergency, once the safety speed of 40-60 kt has been established, to ensure that residual accumulator pressure causes no asymmetry in forces across the flight controls.
In emergency procedure training, the HYD TEST switch is used to induce hydraulic failure in flight and the HYD CUTOFF switch is used to conduct hydraulic off landings. If either switch is in, the system will not provide hydraulic pressure to the controls. As previously detailed in the section titled Hydraulic failuretraining, they should not be activated together in the AS350BA, so hydraulics can be restored with one switch.
Figure 5: HYD TEST switch and HYD CUTOFF switch locations
Source: Airbus Helicopters
Main rotor system
The AS350 was fitted with a starflex hub (Figure 6). This design replaced hinges with elastomeric (rubber type) bearings. Without hydraulic assistance, the pilot must exert significant effort to push or pull the flight controls to deform the elastomeric bearings, change the pitch of the blades, and control the helicopter.
Figure 6: AS350 main rotor pitch change mechanism
Source: Airbus Helicopters
The RFM states in section 3.2 that the expected control input forces without hydraulic pressure are:
Left-hand cyclic load 4 to 7 kgf
Forward cyclic load 2 to 4 kgf
Collective 20 kgf.
The RFM states in section 7.7 that the maximum forces a pilot should have to exert are:
Lateral cyclic 15.3 kgf
Longitudinal cyclic 17.3 kgf
Collective forces were not stated.
Tail rotor system
The AS350 tail rotor is built on one continuous composite spar (Figure 7). Without hydraulic assistance, the pilot must push the pedals and twist the spar to change the pitch of the tail rotor blades. While helicopter weight and speed affect pedal force, the Royal Australian Air Force (RAAF) Aircraft Research and Development Unit (ARDU) (see section titled Research) found that a tail rotor pitch change requires a force of up to 50 kgf. Airbus Helicopters advised they were able to demonstrate significantly lower required forces in flight tests while observing flight manual limitations.
Figure 7: AS350 Tail rotor
Source: Airbus Helicopters
Automatic pilot
The aircraft was fitted with a two-axis automatic pilot system. The installation included two servos in line with the cyclic control’s pitch and roll control rods. The optional collective-to-yaw linkage, that can accompany this equipment, was not a part of this installation. The automatic pilot system was not a component of the endorsement, nor was it used during the endorsement. When the automatic pilot is disengaged, the servos of the automatic pilot system act in the same way as a push/pull rod. There was no evidence to indicate that the automatic pilot system was a factor in the occurrence.
Site and wreckage inspection
Aerodrome information
Hobart Airport is on the south-east coast of Tasmania and has a single north‑west/south‑east runway (Figure 8). Helicopter training area X-Ray was used on the day of the accident.
Area X-Ray was on the western side of, and 60m outside of, the runway. It was under the control of air traffic control (ATC), who provided clearances for all aircraft movements on and around the airport. A clearance was required for helicopters to overfly active taxiways and cross the runway.
Figure 8: Helicopter training area X-ray at Hobart International Airport
Source: Google earth, annotated by the ATSB
Site inspection
As the accident closed the only runway, Tasmania Police assisted the ATSB by documenting the site prior to the arrival of the on‑site investigators. This allowed the wreckage to be removed, and the airport to be reopened, without jeopardising important physical evidence such as ground contact marks. ATSB investigators examined the wreckage in a secure location nearby.
There was evidence that the engine was running for a period of time after the helicopter impacted with terrain, as indicated by burnt grass in the area of the engine exhaust, though there was no fire on site. Figure 9 shows the aircraft before removal.
Figure 9: Accident site image
Source: Tasmania Police
Survivability
Immediately after the accident, ATC activated the emergency response and closed the runway. The aviation rescue and firefighting services (ARFF) stationed at the airport responded immediately to the event, reaching the accident site in 1 minute 40 seconds. The ARFF recovered the CFI from the left seat and assisted the PUI from the right seat.
Damage was indicative of significant impact on the front left side. The flexible steel legs of the skid gear, four-point harnesses, crash-resistant seats and light alloy frame of the cabin floor, all offer protection to occupants during accidents if the helicopter contacts the ground in a level attitude. The polycarbonate construction of the cabin offers very little protection to occupants if the collision involves contact with the canopy.
Investigation of previous AS350 hydraulic failure accidents identified that on initiation of the loss of control event the aircraft often rolled to the left, and initial impact with ground was on the left-hand side. Consequently, the left seat occupant is likely to experience the highest impact forces during a collision. In this accident, the helicopter impacted the ground nose down while rolling to the left. As a result, there was significant disruption to the survivable space on the left side of the helicopter’s cabin.
Both pilots were wearing seatbelts with upper torso restraints, and the seatbelts and seats held during the accident sequence. This kept the right-seat pilot within a disrupted but liveable space within the cabin, contributing to his survival.
Wreckage inspection
The aircraft was inspected at a facility in Hobart.
Engine controls were found connected and secured with all attaching hardware present. The engine oil system was inspected, the oil filter, chip detector and oil were free from debris and discoloration. Fuel was tested for presence of water with no positive indication. The fuel had a clear appearance, the fuel filter was clean, and the bypass indicator was indicating normal operation.
The main rotor transmission had clean oil, the casing was intact, and the chip detector was free of debris. The tail rotor gearbox rotated freely with no binding, and the chip detector and gearbox oil was free of debris. The oil quantity was at the correct level.
Flight control linkages to the main rotor and tail rotor were connected, and securing hardware was in place. The hose supplying the tail rotor servo with pressure was found fractured; detailed examination concluded that was a result of impact damage.
The hydraulic system lines were mounted and connected correctly, and the hydraulic pump and drive belt were intact. The hydraulic fluid had a clear appearance, and the oil, chip-detector and filter were free of debris.
The back-up accumulators fitted to main rotor servos were checked for nitrogen charge and found to be serviceable. All hydraulic system shutoff valves (main and servo-mounted) were present and in place, with the wiring connected. Servo actuators were securely mounted with all electrical plugs and control rods securely in place.
Hydraulic system configuration
The HYD CUTOFF switch and the HYD TEST switch were found in the correct position for restoration of hydraulic pressure at the time of impact (Figure 10). It is possible that one or both switches moved during the impact sequence. The HYD TEST switch unit was found outside of the aircraft, in the off (normal operation) position.
Figure 10: HYD CUTOFF switch and control console as found
Source: ATSB
No pre-existing defects were identified. All damage noted was consistent with impact forces during the accident sequence.
The following items were collected for further assessment:
Pilot’s collective lever HYD CUTOFF switch
HYD TEST switch
Caution and Warning panel.
Hydraulic cut-off switch examination
The HYD CUTOFF switch is an ‘on condition’[7] component which is tested during pre-take-off checks, prior to every flight. Neither the initial instructor nor the PUI reported any anomaly with the switch prior to the accident flight.
Laboratory examination and comparative analysis of the HYD CUTOFF switch from VH-BAA was conducted with a new switch. They found that the switch fitted to VH-BAA at the time of the accident was susceptible to intermittent operation. The switch had a level of wear, corrosion, contamination and internal damage (Figure 11). Consequently, the mechanical latching and unlatching which cycled the internal contacts to ON or OFF could stick, and require additional effort to latch or unlatch.
Therefore, it was possible to action the HYD CUTOFF switch without restoring hydraulics, inducing a genuine emergency. The system’s normal 3-second activation period could delay diagnosis of a fault.
Additionally, Part 4.3 of section 7.7 of the RFM describes abnormal operations of the hydraulic system. It discusses the possibility that the switch may fail to dump hydraulic pressure from the accumulators in the event of an emergency.
The HYD CUTOFF switch may not be effective in opening all the electro-valves, and dumping all the pressure in the accumulators simultaneously…if the hydraulic cut-off switch is rendered ineffective due to the loss of electrical power, broken wires, or a faulty switch.
The manual made no comment on the opposite case of the switch failing while restoring hydraulics after hydraulic failure training.
It could not be determined if the intermittent operation was due in part to impact‑induced damage.
Figure 11: Corrosion, contamination, and wear in VH-BAA switch
Source: ATSB
Hydraulic warning system light bulb analysis
When the hydraulic system is inoperative, two incandescent bulbs light the red HYD warning light (Figure 12). Both of these bulbs were inspected for impact damage (Figure 13). The left bulb was intact and the right bulb exhibited pole whip damage (Carver, 1987). The pole whip created a brittle fracture between the terminal and the support post. There was some observed filament sag, which is consistent with an aged bulb exposed to high-impact forces. If the bulbs were illuminated at impact, provided the impact forces were sufficient, it is likely that the filaments would show evidence of stretch-type deformation damage. Therefore, it is considered probable that the HYD warning light was not illuminated at the time of impact.
The aircraft did not carry any recording devices, nor was it required to.
Closed circuit television
Closed circuit television (CCTV) from the regular public transport apron of the Hobart Airport captured VH-BAA during approach, loss of control and impact. Figure 14 shows the point of view from the apron CCTV.
Figure 14: Apron CCTV point of view
Source: Hobart Airport, Google Earth, annotated by the ATSB
Related occurrences
The ATSB reviewed 34 investigations of accidents involving AS350 series helicopter’s hydraulic systems worldwide. Figure 15 collates the data from ten of the accidents that occurred prior to the accident in VH-BAA, involving simulated hydraulic failure during flight training. It indicates that loss of control accidents during training do happen to highly experienced pilots. Refer to Appendix A for a synopsis of the reports and the Transport Safety Board of Canada’s report A05F0025 for a list of AS350 loss of control events.
Figure 15: Overview of related hydraulic failure training accidents.
Source: ATSB
Reports of unmovable controls have been a feature of a number of accidents following commanded/uncommanded hydraulic failures in AS350 helicopters. First-hand accounts relate that, as well as the rapid and intense changes in direction and magnitude of control forces described in the flight manual, the controls can become immobile.
The manufacturer is clear on avoidance of loss of control, yet the concern of unmovable controls, which is still reported in contemporary production models of the AS350 (see AAIB report EW/C2017/05/01 page 5), is not accepted by the manufacturer. Airbus Helicopters contends that pilots are surprised by the forces required and that prevents pilots from applying sufficient force to the flight controls.
Research
AS350BA controllability research and recommendations
In 1997, the RAAF ARDU conducted an evaluation of the handling characteristics of the AS350BA, in flight without hydraulic assistance.
ARDU found lateral forces with a 30 kt wind from 30° to the front right (a 15 kt crosswind component) caused lateral cyclic forces to vary continuously and ‘satisfactory lateral control could not be achieved’.
The forces required at the controls without hydraulics recorded during that evaluation were:
longitudinal cyclic 14.8 kgf forwards at 1,700 kg all up weight while established in a hover
lateral cyclic 6.8 kgf with a crosswind component of 15 kt
collective (lifting) 16.2 kgf at 1,950 kg all up weight into wind at 15 kt.
Furthermore, ARDU found that at low speed with hydraulics out, pedal authority was reduced by up to 27 per cent, and that passage through free play in the pedals was required to effect a change in heading. These conditions made control difficult to retain and harder to recover. Right pedal force of 50 kgf was required to maintain a heading into wind at 15 kt.
The ARDU report concluded that with hydraulics out:
reduced authority, free play, and excessive control forces in primary flight controls were unacceptable
controllability below 15 kt airspeed was not reliable, and hover flight could lead to loss of control.
Following the evaluation, ARDU recommended that when conducting hydraulic failure training:
use only one hydraulic switch at a time to simulate failure of the hydraulic system
The pilot under instruction (PUI) was unable to recall the majority of the practice hydraulic failure exercise after the accident. As such, there was no firsthand account of the final stages of the accident flight and the sequence of events was largely assembled from closed circuit television (CCTV) footage and wreckage examination.
This analysis will examine the observed aircraft behaviour associated with the simulated hydraulic system failure, instructor intervention, and crew coordination.
Flight manual requirements
In order to safely conclude a practice hydraulic failure sequence, the rotorcraft flight manual (RFM) requires a flat final approach into wind and a no-hover/slow run‑on landing around 10 kt. This is a compromise to keep the helicopter in ground effect and avoid hovering while maintaining a manageable run-on landing speed for potentially unprepared surfaces. Additionally, the requirement to conduct the run-on landing into wind provides a level of consistency in the direction of airflow across the main rotor. This simplifies the pilot’s task by minimising changes to direction and magnitude of cyclic input.
Assurance of control does not require restoration of hydraulics if the helicopter is accelerated into forward flight before the aircraft slows too much. The aircraft becomes easier to control as it is accelerated from 10 kt to the RFM safety speed of 40‑60 kt. If restoration of hydraulics fails at the safety speed, the pilot in command has ample controllability to manage the genuine emergency.
Loss of control
Approaching crosswind
While the RFM requires an into wind approach, the sequence in VH-BAA was planned for approach and landing in a right crosswind of 15-25 kt. Crosswind changes the airflow across the main rotor as the aircraft slows and the crosswind becomes the dominant flow. As detailed in the Royal Australian Air Force Aircraft Research and Development Unit (ARDU) research report, this creates unpredictable changes in direction and magnitude of cyclic input, which are more pronounced when the crosswind is variable, as it was on the day. This significantly increased the pilot’s workload and can render the helicopter uncontrollable.
Analysis of the flight path of VH-BAA from the CCTV footage showed the helicopter to be controlled during the early stages of the approach. As the aircraft slowed, and the crosswind became the dominant airflow the helicopter was observed to drift and vary in pitch and yaw, consistent with the ARDU flight test observations.
Hovering without hydraulic assistance
The PUI recalled feeling a need to prevent the helicopter’s airspeed from decaying late in the approach; CCTV shows he was unable to do so. For a 3-second period, as the helicopter slowed to a hover, there appeared to be no positive control on the aircraft. Despite that, there was no apparent intervention to prevent the helicopter slowing to an out of ground effect (OGE) hover, and the sequence progressed past the boundary of assured control.
The helicopter yawed left, putting the wind behind the helicopter, and facing into an active runway. It is unlikely that this situation was commanded by choice. Instead, it is indicative of the tail rotor returning to a neutral pitch in the absence of hydraulic assistance and reduced, or ineffective, control inputs.
The OGE hover increased the magnitude of control inputs required and induced rapid random changes in intensity and direction of control feedback forces. Due to aerodynamic couplings between controls and lag in control input and response, pilots must anticipate control inputs, and make them before they are required. However, a pilot cannot anticipate the inputs required for an aircraft subject to random perturbations in flight controls.
CCTV showed that after the aircraft came to a hover and yawed left, a positive collective input was made, and the aircraft climbed. It is not known who made that input. Shortly thereafter, control of the aircraft appeared to be lost as it crossed the active runway, with excessive pitch nose down, and left roll developing. Given the nature of the helicopter movement and proximity to the ground, there was little opportunity at that point to restore control.
It is extremely unlikely that the chief flying instructor (CFI) would have entered an active runway without clearance in normal operations. An air traffic controller stated that the CFI had never previously departed area x-ray without announcing his intentions and gaining a clearance. It is therefore virtually certain that entering the runway must have been unavoidable once the aircraft departed controlled flight or considered necessary to regain control of the aircraft.
Deviation from standard operating procedures decrease safety margins and increase opportunity for an accident (Sumwalt and Lemos, 2010). Both the flight manual and the ARDU research paper identified that operating outside of the prescribed procedure would probably result in a loss of control.
Control not restored
Hydraulic system restoration
Light bulb analysis of the hydraulic system fault warning lights indicated that it was probable that the HYD fault light was not illuminated at the time of impact with terrain. Further, both the HYD TEST and the HYD CUTOFF switches were in the normal flight (hydraulic system on) configuration during post-accident examination. While the switch position is less reliable than the light bulb analysis, in combination the ATSB concluded that it was likely that the switches were moved to restore hydraulics prior to impact.
The collective input immediately prior to crossing the runway was 9 seconds prior to collision with terrain. The hydraulic system was likely restored at a point between 9 seconds and 4 seconds before impact. As identified during the investigation of past similar accidents, delays in restoration of the hydraulic system can prevent control recovery.
Restoration of the hydraulic system was potentially delayed due to:
use of an incorrect hydraulic failure training procedure
lack of a pre-flight brief to develop common understanding between crew
a potential intermittent failure of the HYD CUTOFF switch.
The level of contribution, if any, of each factor could not be determined, though each increased risk in the operation.
Incorrect hydraulic failure training procedure
The procedure used to simulate failure of the hydraulic system did not match the requirements of the RFM and overlapped the two phases of the procedure. It released the hydraulic test (HYD TEST) switch after activation of the hydraulic cut-off (HYD CUTOFF) switch. This introduced a hazard into the operation.
Distraction could lead to the HYD TEST switch being forgotten and remaining in. In this configuration, a pilot must activate two switches to restore hydraulics. This would lead to a failure to restore hydraulics when commanded via the HYD CUTOFF switch. Such an event would lead to delayed restoration, due to time taken to diagnose the problem and release the HYD TEST switch. Although as detailed in the section above, it is probable that the HYD TEST switch was released during the occurrence flight, it could not be determined at what point that occurred.
Crew coordination and pre‑flight preparation
Instructing is a complex task and instructors must balance the benefit to the student’s learning and experience with safe margins of operation in a dynamic environment. Instructor intervention is a critical control in flight training. It is often the final opportunity to retain control of the aircraft.
In intervention, an instructor has three time-sensitive options:
adjust – fix the issue and allow student to continue
restore – return to normal flight
complete – take over and complete the sequence.
Intervention is supported by clear assessment, communication, and planning. The PUI received a classroom briefing on emergencies from the original instructor and the CFI received a briefing on the status of the PUI from the same instructor. However, possibly due to the delayed departure, the CFI and PUI did not conduct a pre-flight briefing.
The requirement for a pre-flight brief, especially where non-normal operations are conducted is well-established. Such a briefing reaffirms standard operating procedures, promotes predictable behaviour, and sets expectations among crew (Sumwalt and Lemos, 2010). In this case, the absence of a brief was a missed opportunity to establish correct procedure and generate a common understanding of how the practice emergencies would be conducted.
Once in the aircraft, the CFI advised he would announce practice emergencies and expected the PUI to fly and manage the aircraft. Any unannounced emergencies were to be considered real and the PUI should take immediate essential actions; the CFI would take over if necessary. This is a commonly relied upon arrangement in flight training yet, as an unsafe condition can develop rapidly during the simulation of emergencies, it often requires further definition and understanding between the pilots to be effective.
Additionally, during emergency training, the transition from practice emergency to a genuine emergency is not always clear. Ordinarily available cues for an emergency are defeated, warning lights may already be illuminated, and alarms may or may not sound. The PUI has, by definition, little working knowledge of the aircraft to support diagnosis. Not knowing the aircraft state creates ambiguity, which is known to delay decision-making (Orasanu, and others, 2001).
On this occasion, the absence of a shared mental model of when or how to terminate the sequence may have led to:
no one controlling the aircraft
both pilots controlling the aircraft
a late intervention to prevent hovering
a delay in restoration of hydraulics.
Due to a lack of available information however, it was not possible to determine to what extent the lack of pre-flight brief contributed to the accident.
Findings
From the evidence available, the following findings are made with respect to the fatal loss of control accident involving Eurocopter AS350BA, registered VH-BAA at Hobart Airport on 7 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The rotorcraft flight manual hydraulic failure emergency procedures were not followed. Specifically, the final approach was flown with a significant right crosswind and the helicopter was allowed to slow to a high hover.
The hydraulic failure training sequence was allowed to progress to a point where control was no longer assured.
Hover flight without hydraulic assistance led to loss of control of the aircraft.
The hydraulic system was restored too late in the sequence to recover control of the aircraft. The reason for late restoration could not be determined.
Other factors that increased risk
The operator did not follow the hydraulic failure simulation procedure required by the manufacturer. This introduced a hazardous condition with potential to delay restoration of hydraulic assistance.
The collective mounted hydraulic cut off switch showed signs of excessive wear and intermittent operation. The switch may have required multiple actions to return hydraulic assistance when activated, potentially delaying restoration of the hydraulic system.
The chief flying instructor and pilot under instruction did not conduct a pre-flight brief, to develop a shared understanding of how the hydraulic failure sequence would be conducted. This may have led to confusion over aircraft control and delayed restoration of the hydraulic system.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Kouabenan, D.R., Ngueutsa, R., Mbaye, S. 2015, Safety climate, perceived risk, and involvement in safety management, Safety Science, 77, 72-29.
Orasanu, J, Martin, L, & Davison, J. (2001). Cognitive and contextual factors in aviation accidents, in E Salas and G Klein (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.
Sumwalt, R.L., Lemos, K.A. 2010, The Accident Investigator's Perspective, Crew Resource Management, pp. 399-423.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight-training organisation, pilot under instruction, instructor, Airservices Australia, the Civil Aviation Safety Authority, the Bureau of Meteorology, and the aircraft manufacturer.
Submissions were received from the flight-training organisation, the Civil Aviation Safety Authority, the instructor and the aircraft manufacturer. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A - Synopsis of related occurrences
National Transportation Safety Board (US) LAX92FA025 - 1991
At an airspeed of about 2 knots and a skid height of about 1 foot, the helicopter began an uncommanded turn to the left. The pilot attempted to counter the turn but was unable to move the flight controls. The helicopter's left bank angle, nose down attitude and left turn continued until the main rotor blades struck the ground.
National Transportation Safety Board (US) IAD99GA056 - 1999
The aircraft developed an uncontrollable roll to the left while hovering without hydraulic assistance.
…the helicopter began an uncontrollable roll to the left while at the hover…I tried to level the helicopter by using both hands to attempt to pull the cyclic control to the neutral/level position. The helicopter continued to roll left and subsequently the main rotor blades hit the ground.
Excessive flow rates were detected in all servos and two were rejected in a speed test.
National Transportation Safety Board (US) LAX00LA195 - 2000
The student struggled to control the aircraft towards the end of an approach with hydraulics off. The instructor took over and requested return of hydraulics. The student switched on the hydraulic system. Controls remained stiff and the helicopter impacted terrain.
He reported that just prior to touchdown, the aircraft controls became very stiff. At that point, the flight instructor directed the pilot trainee to re-engage the hydraulics isolation switch on the collective control. The student re-engaged the hydraulics but reported that the controls remained stiff, and he was having difficulty applying forward cyclic. As the instructor got on the controls it started a slow turn to the left. As the instructor attempted to counteract the turn rate increased. The helicopter impacted the ground in a left turn with rear lateral movement.
National Transportation Safety Board (US) ATL02LA097 - 2002
The training and checking captain was unable to control the aircraft while hovering without hydraulic assistance.
The check airman then stated that he would demonstrate the handling characteristics of the helicopter in the hydraulics off configuration. The check airman brought the helicopter to a hover approximately three feet above the ground. At that time the helicopters nose appeared to pitch up dramatically. This attitude was followed by a simultaneous rotation about the yaw axis. As the spin accelerated the check airman instructed the airline transport rated pilot to restore the hydraulics, which was done by depressing the switch on the collective. The rotation of the helicopter continued, and the helicopter impacted the ground coming to rest on the right side of the fuselage.
National Transportation Safety Board (US) ANC02FA029 - 2002
He brought the helicopter to a hover about four feet above the road. According to the pilot, the cyclic was frozen in the full aft left position when he lost control. The helicopter rolled left and struck the ground inverted.
Air Accidents Investigation Branch (UK) EW/C2004/10/05 - 2004
The AAIB found that the instructor did not follow flight manual procedure for hydraulic failure training, leading to the HYD TEST switch being activated at the same time as the HYD CUTOFF switch. The instructor did not attempt to restore hydraulics and was unable to recover the aircraft.
Transportation Safety Board of Canada A05F0025 - 2005
As the pilot gradually descended, and at a height of about 10 feet above ground level, he experienced significant binding in the flight controls. The pilot was unable to rectify the control binding and had considerable difficulty maintaining attitude and altitude control of the helicopter.
It should be noted that the pilot had not received any of the conventional alerts of hydraulic malfunction, such as the klaxon or the warning light.
National Transportation Safety Board (US) LAX07GA217 - 2007
While attempting to regain control at the bottom of a failed hydraulics off approach, the student did not restore hydraulics when requested by the instructor. The student stated that they were told it was dangerous to do so as it could induce over control. The instructor was unable to recover the aircraft.
The CFI [chief flying instructor] noted that the slowest airspeed the helicopter ever reached was a minimum of 8 kts. He added that he was not sure if the cyclic was immobile in any additional direction, aside from the forward-right position, as he did not move it into another direction to prevent possible further loss of control of the helicopter. The CFI estimated that he performs hydraulics-off simulated emergency procedures on a regular basis; he has never experienced any problems or difficulty controlling the helicopter.
A lateral servo was found to be rigged out of limits and mushroom deformation existed on the longitudinal servo.
National Transportation Safety Board (US) LAX08IA042 - 2007
Unlocking pressure on one hydraulic servo was too high and created a control lock. The instructor landed the helicopter by following the emergency procedure from the flight manual.
The CFI immediately noticed that an abnormal force was required on the cyclic control to prevent the helicopter's nose from pitching up and to the left.
The CFI elected to continue the landing with the hydraulics off …. He managed to complete a run-on landing without mishap by maintaining an airspeed of about 10 kts. When the helicopter came to rest, the pressure was released on the cyclic and the second pilot restored the hydraulics via the collective switch. Immediately thereafter, the cyclic began a hard over and displaced to the left against the CFI's leg. He attempted to center the cyclic with both hands, but he was unable to move the control.
National Transportation Safety Board (US) WPR10LA046 - 2009
The student lost control during hydraulic failure training. The instructor’s delayed input and a lack of positive exchange of control contributed to accident.
The instructor told the PUI [pilot under instruction] to turn the hydraulics back on. The helicopter continued in a nose low attitude and in a left bank of about 15-30 degrees. The pilots both stated that they could not move the cyclic in the lateral axis. The helicopter continued the rotation with the nose low attitude until ground impact.
Transportation Safety Board of Canada A13Q0021 - 2013
The TSB found that the instructor did not follow flight manual procedures for flight without hydraulic assistance. The instructor encountered heavy unpredictable control forces and could not recover from a steep left roll.
The flight instructor took off in manual mode and again flew a tight left pattern at low speed and low altitude. At the end of the base leg, at the beginning of the final approach, the helicopter momentarily reached a level attitude. Just before the flight instructor handed the controls to the pilot in training, the helicopter banked slightly to the left and then quickly rolled to the left in a nose-down attitude, and the main rotor struck the runway.
Air Accidents Investigation Branch (UK) EW/C2017/05/01 - 2017
The instructor lost control while flying a tight low-level left-hand circuit without hydraulic assistance and at a high angle of bank.
When interviewed, the instructor stated that he had been unable to move the cyclic control to the right to arrest the roll to the left.
Appendix B
For a full copy of the safety information notice click the hyperlink
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
On 28 October 2017, a Cessna Aircraft Company T310R, registered VH-JMW, was being operated on a private flight from Toowoomba, Queensland to The Lakes aerodrome, New South Wales. The aircraft had been flown from The Lakes to Toowoomba earlier that day. The aircraft departed Toowoomba at 1434 Eastern Daylight-saving Time (EDT)[1]. The pilot was the owner of the aircraft and there was a passenger in the other front seat.
During the flight, transponders in the aircraft provided flight information indicating that the aircraft flew at 9,500 ft in the cruise. Weather forecasts and observations indicated good weather conditions throughout the flight, with a light easterly wind in the vicinity of the destination.
About half a nautical mile north of The Lakes aerodrome, witnesses driving south on the Pacific Highway observed the aircraft flying just to the west of the highway at low altitude in a southerly direction. The landing gear was extended and the aircraft was descending slowly. The aircraft was then observed to roll left and descend rapidly.
The aircraft collided with terrain at approximately 1555, in a narrow wooded strip of land east of the Pacific Highway, between the highway and the main northern railway line. The accident was 800 m from The Lakes runway 16 threshold, in line with the runway direction (Figure 1). The pilot and passenger were fatally injured.
Figure 1: Flight path approaching The Lakes. Radar data was lost below 900 ft altitude
Source: Google Earth modified by ATSB
Aircraft information
VH-JMW was a Cessna T310R, six seat, twin-engine aircraft, powered by two Teledyne Continental Motors TSIO-520-NB turbocharged engines (Figure 2). It had six fuel tanks, comprising the main fuel tanks in the wingtip pods, and two auxiliary fuel tanks in each wing.
Figure 2: Cessna T310R VH-JMW
Source: flightaware.com
Wreckage examination
On-site examination of the wreckage, surrounding markings on trees and the ground indicated that the aircraft impacted terrain in a steep nose-down attitude and banked to the left. The aircraft was in a landing configuration.
The left wing had separated outboard of the left engine, and both the wing-tip pods had separated from the wings. The remaining fuel tanks were also breached and no fuel was found, however a smell of aviation fuel was noted by emergency responders at the accident site. There was no evidence of fire.
Examination of the engines and propellers indicated that the left engine was producing no power and the right engine was likely producing low power at the time of the accident.
A number of aircraft components, instruments and electronic devices were recovered from the accident site by the ATSB for further examination.
The aircraft was not equipped with a flight data recorder or a cockpit voice recorder, nor was it required to be.
Ongoing investigation
The investigation is continuing and will include consideration of the:
pilot’s qualifications, experience and medical information
fuel planning for the flight
component examination
witness information
weather information
recovered instruments and available electronic data.
___________ The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
During the afternoon of 28 October 2017, a Cessna Aircraft Company T310R, registered VH-JMW (JMW) was conducting a return flight from The Lakes airstrip, New South Wales to Toowoomba Airport, Queensland with the pilot and one passenger on board.
On the return flight from Toowoomba, during descent to The Lakes, and while about 8 km from the runway, a witness recalled hearing the sound of what he thought was a single-engine aircraft ‘cough’ and then stop. Shortly afterwards, JMW was seen descending slowly with the landing gear extended. The aircraft then ‘jerked’ suddenly, rolled to the left and descended rapidly to the ground.
The pilot and passenger were fatally injured, and the aircraft was destroyed.
What the ATSB found
The ATSB identified that during the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.
Following the loss of engine power a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.
The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.
Safety message
A loss of power in an aeroplane requires different responses depending on whether the aircraft has single or multiple engines. However, regardless of the configuration, in order to maximise the survivability outcome it is imperative that the pilot retains control of the aircraft and maintains a safe airspeed. Where the aircraft’s performance degrades to the point that continued safe flight is not possible, the pilot must shift focus to conducting a forced landing.
Pilots also need to routinely exercise good fuel-management practices in order to maintain the highest level of safety and avoid fuel exhaustion or starvation events. Civil Aviation Advisory Publication 234-1(2) provides guidance on the current fuel requirements and good fuel-management practices.
Sources and submissions
Sources of information
The sources of information during the investigation included:
a number of witnesses
the aircraft manufacturer (Cessna)
aircraft refuellers
Textron Aviation
The Civil Aviation Safety Authority
The United States Federal Aviation Administration.
References
Jeppesen Sanderson Inc 1992, Multi-Engine Pilot Manual, Jeppesen Sanderson, Colorado.
ATSB aviation research investigation report B2005/0085, Power loss related accidents involving twin-engine aircraft.
ATSB aviation research investigation report AR-2011-112, Starved and exhausted: Fuel management aviation accidents.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to representatives of the aircraft’s occupants, the United States National Transportation Safety Board, the Civil Aviation Safety Authority, and the aircraft manufacturer.
Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.
Findings
From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving a Cessna Aircraft Company T310R, registered VH-JMW that occurred 40 km south‑south‑west of Port Macquarie, New South Wales on 28 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
During the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.
After losing engine power at low altitude, a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.
The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.
Context
Pilot information
The pilot held a:
Private Pilot (Aeroplane) Licence issued on 10 October 2000
current Class 2 aviation medical certificate issued in 2017 without restriction
Night Visual Flight Rules rating and a Private Instrument Flight Rules rating.[4]
The pilot had owned a number of single- and multi-engine aircraft and was endorsed for the Cessna 310 in December 2001.
Extracts from the pilot’s logbook showed that he had in excess of 3,200 hours total flying experience on aeroplanes, with more than 300 hours experience on multi-engine aircraft. He last completed a multi-engine flight review with a flight instructor in May 2017. As part of that review, the pilot demonstrated his ability to manage asymmetric power conditions and simulated one‑engine inoperative exercises at various phases of the flight. The instructor recorded the pilot’s response to these exercises as ‘normal’.
Aircraft information
The Cessna Aircraft Company T310R is a low-wing, twin-engine aircraft equipped with retractable landing gear. In 1988, VH-JMW was modified under supplementary type certificates to replace the original Continental IO-520-MB engines with turbocharged engines (TSIO-520-NB) and fit new three-bladed propellers (Figure 3).
Figure 3: VH-JMW – Cessna T310R
Source: Flightaware.com
In December 2016, a periodic inspection was conducted. The maintenance release did not identify any defects. The release was valid for 100 hours or until 14 December 2017. The only scheduled maintenance task carried out during this release period was an engine oil change. Documentation for the aircraft’s prior maintenance history, including fuel gauge calibration, was not available.
At the time of the accident, the aircraft’s optional equipment included:
a multifunction display
a digital fuel flow indicator and totaliser (digital fuel system), which had replaced the standard Cessna analogue fuel flow gauge
an electronic primary navigation display.
Fuel system
The aircraft’s fuel system consisted of two main tanks located on the tip of each wing, two auxiliary tanks and two wing locker tanks. The dual indicating fuel quantity gauge provided a continuous indication of the fuel remaining in the selected tanks based on fuel weight, for both the left and right sides of the aircraft. The aircraft was not equipped with optional low fuel level indicator lights. The total capacity of the main tanks and the auxiliary tanks was 628 L, with 617 L being usable. The total capacity of the wing locker tanks was 155 L with 151 L of usable fuel.
The main tanks were integrally sealed aluminium tanks, which were vented to atmospheric pressure by a flush vent located on the lower aft portion of each main tank. Each auxiliary fuel tank consisted of two interconnected bladder-type fuel cells located between the wing spars in the outboard section of each wing. The wing locker fuel tanks were located in the forward part of each wing locker baggage area and were also bladder-type cells that supplemented the main tank fuel quantity. The wing locker fuel could not be fed directly to the engines; instead, it was transferred to the main tanks by manually‑selected wing locker fuel transfer pumps.
Two fuel selectors, one for each engine, were located on the floor between the pilot and co-pilot seats. The fuel selectors controlled the wing selector valves to enable switching between the main and auxiliary fuel tanks.
The fuel system comprised the following pumps (for each side to the aircraft):
engine-driven fuel pump (to transfer fuel from the centre sump to the engine)
auxiliary boost fuel pump (to provide fuel pressure for priming during engine starting, and to supply fuel to the engine in an emergency)
main fuel tank transfer pump (to transfer fuel from the nose of the main tank to the centre sump and allow steep descent with low fuel quantity)
wing locker fuel tank transfer pump (to transfer fuel from the wing locker tank to the main tank).
Fuel tank selection
The Cessna T310R Pilot’s Operating Handbook (POH)(Revision 3, 1982) stated:
If auxiliary fuel tanks are to be used, select main fuel for … 90 minutes of flight. This is necessary to provide space in the main tanks for vapour and fuel returned from the engine-driven fuel pumps when operating on auxiliary fuel. If sufficient space is not available in the main tanks for this diverted fuel, the tanks can overflow through the overboard fuel vents.
The POH also stated that in the event of an engine failure, the fuel in the auxiliary tank on the side of the failed engine would become unusable.
The Cessna Aircraft Company’s Pilot Safety and Warning Supplements (1 June 1998) also included this important fuel tank selection sequence. If auxiliary tanks were to be used, this sequence would ensure excess fuel supplied to the engine was collected in the main tanks, and not vented overboard. The incorrect sequence could result in venting fuel, reducing the fuel available to complete the planned flight.
The potential for accidental venting of fuel overboard described above and guidance on correct tank sequence had been widely promulgated for a many years. As such, it was considered unlikely that an experienced pilot would make such an incorrect selection.
Digital fuel system
The aircraft was equipped with a digital fuel system that measured the instantaneous fuel flow to each engine and calculated the aircraft’s endurance based on current fuel flow and the system‑totalised quantity of fuel remaining.
The system did not measure the actual fuel quantity on board the aircraft, instead it relied on a manually entered starting quantity and the system‑calculated quantity of fuel consumed. Additionally, the data presented did not provide the pilot with the quantity of fuel in individual fuel tanks. The pilot had the following manual data entry options:
input the quantity of fuel added
update the system’s computation of fuel remaining
selection of a ‘full’ fuel default.
The ATSB examined the digital fuel system and found that it was correctly configured for the aircraft and operational at the time of the accident. The default ‘full’ value was set to 616 L in the system settings, which closely corresponded with the usable capacity in the main and auxiliary tanks. The system was set to display ‘Lo FUEL’ when the pre-programmed fuel level of 100 L was reached. Once ‘Lo FUEL’ was displayed, the fuel flow information would not display until the pilot acknowledged the warning by pressing ‘enter’.
The system was also configured to display a warning for the flying time remaining (endurance time). When the endurance time reduced below the pre-programmed endurance time of 45 minutes, the data in the right half of the display flashed. This warning required the pilot to acknowledge the warning by pressing ‘enter’.
Operational information
Fuel management
At the time of the accident, the Civil Aviation Advisory Publication, CAAP 234-1(1) Guidelines for Aircraft Fuel Requirements, was in effect.[5] The CAAP recommended a 45-minute fixed fuel reserve[6] and that pilots use at least two independent fuel check methods to establish the quantity of fuel.
Fuel quantity
The last known fuel uplift by JMW was recorded on 12 September 2017. The number of flights undertaken between 12 September and the accident flight meant that the aircraft must have been refuelled during that time. However, no records were found to indicate where, when and how much fuel was uplifted. Consequently, it was not possible to determine the fuel quantity on board the aircraft on departure from either The Lakes or Toowoomba.
There was some indication that the pilot considered the runway length at The Lakes was weight limiting on take-off. While this could suggest JMW did not depart from there with full fuel, that could not be verified. The aircraft was not refuelled in Toowoomba prior to the return flight.
The ATSB found the refuelling facility at The Lakes airstrip had appropriate maintenance placards affixed to the bowser indicating that it was in use. The facility’s fuel tank was about one‑third full, and a test of the fuel indicated no fuel quality issues. The facility was not required keep fuel records.
The supplemental type certificate for JMW under which the turbocharged engines were installed did not provide revised fuel consumption rates. No other documents, such as pilot calculations for the aircraft’s fuel consumption or similar records, were found. In the absence of that information, the ATSB used the fuel consumption rates of a Cessna aircraft (of similar size to JMW and fitted with the same engines) to estimate fuel consumption for the accident flight. This calculation indicated that fuel consumption for the round trip from The Lakes to Toowoomba would be in the order of 425 L.
The on-board digital fuel system recorded a consumption of 563 L (based on the pilot’s last entry and system calculations) and displayed 53 L remaining. If the starting fuel quantity was accurate, there should have been 53 L (616 – 563 L) of usable fuel based on calculations remaining at the time of the accident. However, this could not be verified by independent calculations or physical evidence.
Asymmetric operations
The Cessna 310 has two wing-mounted engines that produce symmetrical propeller thrust during normal operation. When one engine is inoperative, the resulting asymmetric forces will cause the aircraft to yaw in the direction of the inoperative engine, which can be countered through the application of rudder and aileron control inputs. The minimum control speed (Vmca[7]) of 84 KIAS[8] must be maintained to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aircraft. The value of the minimum control speed will vary from the published value with engine power level on the operable engine and aircraft configuration. With the operable engine at low power, the minimum control speed will reduce to a value close to the stall speed.
The intentional one engine inoperative section of the Cessna T310R POH stated that while the aircraft is controllable at Vmca, the performance is so far below optimum that continued flight near the ground is improbable. Therefore, the handbook recommended that a more suitable safe single-engine speed was 92 KIAS. At this speed, altitude could be maintained more easily while the landing gear is being retracted and the propeller is being feathered.[9]
A single inoperative engine on a twin-engine aircraft may not always result in controllability issues that are immediately obvious to the pilot. This point was highlighted in the United States Federal Aviation Administration (FAA) Airplane Flying Handbook:
An engine failure in a descent or other low power setting can be deceiving. The dramatic yaw and performance loss will be absent. At very low power settings, the pilot may not even be aware of a failure.
Aircraft handling following engine failure
The Cessna 310 POH stated that, following an engine failure, the pilot’s first consideration is to maintain control of the aircraft and ensure the airspeed remains above the minimum control speed. It then stated that the pilot needed to identify the inoperative engine, adjust the operative engine as required, and perform a number of checks relating to fuel flow, tank selection and quantity; engine oil pressure and temperatures; magneto switches and mixture. If the engine could not be re-started, the pilot must ‘secure’ or shutdown the engine, which includes feathering the propeller.
The FAA Airplane Flying Handbook provides further practical guidance for managing such a situation. Importantly, the handbook stated that completely securing a failed engine may not be necessary or even desirable depending upon the failure mode, altitude, and time available.
It is recognised that if both engines lose power, the best gliding range will be achieved when the aircraft is flown at the optimum gliding speed and configured for the minimum aerodynamic drag. Guidance for configuring an aircraft following engine failure is provided in the Multi-Engine Pilot Manual by Jeppesen Sanderson (1992):
It is important that the pilot be familiar with the correct order for drag reduction following an engine failure. Normally, a windmilling propeller contributes the greatest amount of drag, followed by full flaps, extended landing gear, and the control deflections required to stop the airplane from turning. Since it is considered unwise to immediately feather an engine before it has been positively identified, drag is normally reduced by first retracting flaps and gear. Next, the failed engine is identified and the propeller is feathered. However, the specific order of drag reduction may vary between types of twin‑engine airplanes, so the manufacturer’s recommendations should be followed.
Based on the estimated weight of JMW, its best glide speed was about 102 KIAS at a glide angle of 4°. Any variation from that target airspeed would have reduced the gliding range. Shortly before the collision, the aircraft’s airspeed was about 67 kt, 35 kt less than the best glide speed.
Aircraft performance degradation
In relation to a previous Cessna 310 accident, the aircraft manufacturer provided information that an unmodified Cessna 310 at maximum landing weight has a single-engine climb rate of about 375 feet per minute at sea level. However, the drag penalties of an unfeathered windmilling[10] propeller, extended landing gear and full flap significantly degrade single-engine climb performance. Under these conditions with one engine inoperative, a penalty to the climb rate of about 850 feet per minute could be expected.
In comparison to standard engines for its aircraft type, JMW’s engines were higher performing. At the time of the accident, JMW had its landing gear extended, propellers unfeathered and flaps at 15° (see the section titled Aircraft configuration). In this configuration, the aircraft descended about 1,100 ft during the last minute of its flight (see the section titled Recorded data).
Recorded data
The aircraft was fitted with an electronic primary navigation display. The recorded data on the navigation system included aircraft pitch, roll and ground speed.
ATSB analysis of the recorded data (partly illustrated in Figure 4) determined that:
About 140 seconds before the collision, the aircraft rolled to the left and then to the right. The aircraft was travelling at about 150 kt at an altitude of 1,600 ft and was approximately 4.5 NM from the The Lakes runway threshold. There was a corresponding heading change to the left of approximately 4° followed by a change to the right of approximately 6°. This sequence could be consistent with asymmetric forces on the aircraft due to the loss of left engine power or a course correction onto the final approach path.
Shortly after, the speed of the aircraft decreased below the maximum flap extension speed (158 KIAS) and the maximum landing gear extension speed (138 KIAS) indicating the pilot did not configure the aircraft into its final configuration until the last 100 seconds of the flight.
From about 1554 (60 seconds before control of the aircraft was lost) the pitch of the aircraft trends upwards from -5° (nose down) to a maximum of 6.5° nose up just before the loss of control.
Just after 1554, the aircraft’s altitude was about 1,100 ft[11] (last known altitude). The aircraft was approximately 2 NM from the runway threshold.
About 30 seconds before the collision and again about 10 seconds before the collision, the aircraft rolled to the left and pitched down with a heading change to the left (Figure 4). This sequence was consistent with asymmetric forces on the aircraft due to the loss of left engine power.
Over the last 30 seconds of the flight, the rate of speed decay increased with the aircraft’s speed reducing to below the published (and likely actual) Vmca, and into the stall speed range (68–74 kt).[12] Constant variations in pitch and roll were evident throughout this stage of the flight, with a continual upward trend in pitch (Figure 4).
Just before 1555, the aircraft’s speed decayed to 67 kt[13] (ground speed). The nose continued to pitch up, attaining a maximum pitch of about 6.5 degrees. Shortly after, the left wing dropped and the nose pitched towards the ground.
Figure 4: Last 280 seconds of recorded flight data
Source: ATSB
Wreckage and impact information
The ATSB’s examination of the accident site confirmed that the aircraft was in a left-wing, nose‑down attitude when it collided with terrain. It came to rest between a railway line and the Pacific Highway in a thicket of gumtrees and coastal scrub. The distribution of the wreckage and the damage to the trees indicated that the aircraft had little forward momentum on impact (Figure 2). The impact forces from the collision destroyed the aircraft.
Aircraft structure
All of the aircraft structure was identified at the accident site. There was no evidence of inflight break-up or post-impact fire. Continuity of the flight control cables and aircraft control surfaces were confirmed as secure or fractured due to overstress, consistent with the ground collision.
There were no pre-existing mechanical defects identified during the examination that would have prevented normal operation of the aircraft. However, there was severe disruption to the aircraft pitot tubes, seats and fuel selector system, making it impossible to determine their serviceability.
The aircraft’s occupant restraint system had been in use during the flight and was working normally.
Aircraft configuration
The wreckage examination showed that the aircraft was configured with the landing gear down and locked, and the flaps extended to 15°. Both the left and right engine propellers were towards the fine pitch, and not feathered.
The position of the flight controls, engine controls and fuel tank selectors immediately prior to the loss of control could not be determined due to the severe disruption of the cockpit and fuselage.
Engines
Continuity of the right engine propeller pitch control was established by visual inspection. The left engine propeller pitch control cable had separated at the governor connecting rod, consistent with overstress failure from impact forces.
The left propeller blades showed no evidence of bending, twisting or chord-wise (that is, across the width of the blade) scratching. This indicated that the left engine was not producing power on impact. On the other hand, one blade of the right propeller showed evidence of forward compound bending, and chord-wise scratching across its face. The spinner and propeller hub were partially buried in the ground with evidence of corkscrewing of the propeller pressure dome cover attached to the spinner. The propeller hub fractured at the crankshaft. Examination of the fracture surface showed that dominant failure load was bending, consistent with no significant power on the right engine at the time of impact with terrain.
An external visual inspection of the left and right engine and engine controls did not identify any pre-existing damage or defects. All of the damage identified (including to the left engine fuel pump and oil sump) was consistent with impact damage from the collision.
The cylinders, sparkplugs, crankcase and external accessories were confirmed secure on both the left and right engine. All of the fuel supply and return lines between the engine firewall and the engine were disconnected and inspected. Negligible fuel was found in the lines (they should contain fuel under normal operating conditions). No blockages in the lines that would have prevented fuel reaching either engine were found.
The left engine oil sump was breached during the impact and a quantity of oil had leaked out and been absorbed in the soil. However, the oil cap was secure and some oil was noted on the graduated dipstick. Oil was also identified in the right engine.
The spark plugs, fuel pump, vacuum pump and all cylinder rocker covers on both engines were removed and inspected. Rotation of the crankshaft on each engine demonstrated continuity of the major engine components. During rotation, the pistons, cylinder rocker arms, vacuum pump drive, fuel pump drive and magneto gears were found to move through their normal range. An endoscope was used to determine that the pistons, valves and cylinders were in normal operational condition.
The left and right engine turbo charger inlet and outlet impellors were inspected and nil damage identified. The absence of damage provided inconclusive evidence to indicate whether the turbo chargers were powered at the time of impact.
There was no evidence found during examination of the engines to indicate that either engine was incapable of normal operation.
The fuel system
Both the left and right main fuel tanks separated from the wings following overstress failure at the spar attachments, and were found between 5 and 10 m from the main wreckage. Impact forces from the accident breached both the tanks, but their fuel caps were found in place and secured.
The left and right auxiliary fuel tanks were holed and crushed during the accident. There was some evidence of discolouration under the left wing resulting from fuel weeping from the left auxiliary tank. This weep was assessed as minor and therefore considered to have had a negligible impact on the usable fuel quantity.
The left- and right-wing locker tanks were intact but the interconnecting pipes had fractured during the accident. There was no evidence of fuel in either tank.
There was no fuel-fed post-impact fire or evidence of fuel tank deformation resulting from a large quantity of fuel impacting the internal walls of the fuel tank during the accident. While the first persons to arrive at the accident site reported smelling fuel, others who arrived shortly afterwards did not smell fuel. This could be indicative of the smell of fuel vapour from ruptured tanks, which then dissipated. Further, ATSB investigators found a negligible quantity of fuel in any of the tanks or around the wreckage. They also observed no dieback of vegetation at the accident site in the days following the accident that is typical of a fuel spill.
The main fuel tank transfer pumps were tested and found to be operational; therefore, even with the aircraft in a steep descent all of the usable fuel in the main fuel tank was available for use. The left engine fuel pump could not be tested due to severe impact damage, while the right engine fuel pump was not tested as it was evident that the right engine was producing some power at the time of the collision. A small amount of fuel was found in each of the fuel distributors, indicating that both of the engine fuel pumps were operational prior to the accident. The small quantity of fuel may have been due to a low fuel volume in the tanks.
Power loss accident rates in twin-engine aircraft were almost half that for single-engine aircraft.[14] However, a power loss accident in a twin-engine aircraft was more likely to be fatal and overwhelmingly the result of in-flight loss of control.
Of the 58 accidents identified between 1993 and 2002 that resulted in damage following the power loss, seven occurred during the approach phase of flight. Three of these involved a loss of control, including one fatal accident. When compared to the take-off phase, the approach phase is considered to be equally risky, with low altitude and only a little more energy available than during the take-off phase.
Just over one-third of power loss accidents in twin-engine aircraft occurred during a non‑asymmetric power loss. The majority of these were related to fuel management, and no benefit was derived from the presence of a second engine.
Another ATSB research report, Starved and Exhausted: Fuel management aviation accidents (AR-2011-112) summarised key occurrences related to fuel management and outlined procedures pilots can use before and during the flight to ensure they land with reserve fuel intact.
This report includes the following key safety messages.
Accurate fuel management starts with knowing exactly how much fuel is being carried at the commencement of a flight. If the tanks are not filled to a known setting, then a different approach is needed to determine an accurate quantity of usable fuel.
Keeping fuel supplied to the engines during flight relies on the pilot’s knowledge of the aircraft’s fuel supply system and being familiar and proficient in its use. Adhering to procedures, maintaining a record of the fuel selections during flight, and ensuring the appropriate tank selections are made before descending towards your destination will lessen the likelihood of fuel starvation at what may be a critical stage of the flight.
Physical evidence at the accident site allowed the ATSB to establish, that VH-JMW (JMW) was operating in a low engine power state when it collided with terrain. Similarly, recorded flight data and witness reports enabled analysis of the sequence of the aircraft’s loss of control in the lead up to the collision. The following analysis details the factors that contributed to the development of the accident.
Engine power loss
Examination of the wreckage identified that the aircraft was configured for a powered approach, in a high‑drag configuration - left and right engine propellers unfeathered, landing gear down and the flaps partially extended. Based on the recorded data, the landing gear and flaps were extended within the last 100 seconds of the flight and the airspeed reduced significantly over the same time period. Maintenance of a high‑drag configuration while the aircraft’s performance declined indicated that either the pilot did not recognise any engine abnormalities until late in the approach, or he assessed that sufficient engine power remained to reach the runway.
The nature, type and extent of damage to the propellers (bending, twisting and scratching to each), and examination of the fractured right propeller flange showed that, at the time of collision:
the left engine was not producing power
the right engine was not producing significant power.
No evidence was found to indicate a mechanical defect that would have prevented either engine from developing full power.
The ATSB considered whether the assessed low engine power levels at the time of the collision also existed immediately before the loss of control. While it is possible that the pilot may have reduced the engine power in the final moments, given the significant recorded decline in aircraft performance over the last two minutes of the flight, the low power state probably existed immediately prior to the accident. Distortion of the engine controls during the collision prevented identification of the selected power setting.
The positive nature of the text message sent about 14 minutes before the collision, indicated that the aircraft was performing as expected at that point in the flight. However, about 2 minutes and 20 seconds before the collision, at an altitude of 1,600 ft, the recorded data showed a large deviation in the aircraft roll and heading. Those deviations were consistent with a left engine power loss. Control of the aircraft’s pitch, roll, heading and speed declined from this point on (Figure 4).
In the last minute of flight, JMW’s descent rate was higher than expected for the aircraft type when operating on one engine in a high drag configuration. That indicated that the operative right engine was likely producing reduced power. Based on witness observations, it is possible that the right engine had intermittent power rather than a consistently low output.
In summary, the ATSB assessed that, shortly before the collision, the left engine had stopped producing power and the right engine was operating at low or intermittent power.
Loss of control
From the available evidence, it could not be determined when the pilot became aware of the left engine power loss. Consistent with the guidance in the United States Federal Aviation Administration Airplane Flying Handbook, it is possible that the power loss may not have been obvious as the aircraft was descending. Similarly, apart from extension of the landing gear and flap, it was impossible to determine the pilot’s response to the power loss and his subsequent actions. However, it is relevant to note that he had started an apparently normal descent minutes earlier (soon after 1541). He was also flying over thickly‑wooded terrain, and was very close to the destination before control was lost.
Recorded data enabled the loss of control to be better explained (Figure 4). The low engine power combined with the high-drag configuration meant that the aircraft’s speed and altitude could not be maintained. This in turn led to the airspeed declining to below the published Vmca and into the stall speed range. As the right engine was likely not operating at full power, the actual Vmca was less than the published figure and likely in the region of the aircraft’s stall speed. As the speed continued to decline, the nose was progressively pitched up to about 6.5°. The left wing and nose then dropped towards the ground resulting in a collision with terrain. That flight behaviour with the airspeed in the region of both the stall speed and Vmca, indicated a loss of control due to either a low-speed stall, asymmetric effects or a combination of both.
Fuel-related factors
There was no evidence of a mechanical defect to explain the apparent engine power losses. However, the absence of fuel in the supply and return lines indicated that sufficient fuel was not reaching either engine at the time of the collision. This, and other fuel-related evidence, resulted in the ATSB exploring potential fuel starvation and exhaustion scenarios, and related factors.
As no fuel uplift occurred in Toowoomba before the accident flight, JMW departed The Lakes with a fuel quantity that the pilot considered sufficient for the return flight. However, with no fuel records or other evidence available, that quantity could not be determined. It is possible that there was sufficient fuel for the return flight as anticipated by the pilot and the wreckage examination did not identify any pre-existing fuel tank leaks that could have affected the storage capacity.
After the aircraft began its descent to The Lakes, recorded roll and heading deviations indicated that the left engine lost power first due to insufficient fuel supply. The right engine’s loss of power, some time later, was consistent with the expected slight variation in fuel consumption and tank fuel quantities between the left and right systems.
The on-board digital fuel flow indicator and totaliser indicated there were 53 L of usable fuel in the tanks at the time of the collision. However, this was not a measured quantity but a system‑calculated figure based on consumption, and relied on an accurate starting quantity. While the system was correctly set up, the ATSB could not verify this figure because there were no fuel records or fuel consumption rates. The absence of fuel damage to vegetation at the accident site, no post-impact fire and no strong, persistent fuel smell, supported a conclusion of minimal fuel on board. The ruptured fuel tanks made it impossible to determine (or estimate) the fuel quantity that they had contained.
The investigation considered the possibility of inadvertent venting of fuel overboard due to the incorrect sequence of selecting fuel tanks (auxiliary before main tanks). However, given the pilot’s significant experience and familiarity with the aircraft type, and the well-known tank selection sequence, it is unlikely that he would have made such an error.
The investigation also considered a scenario where the pilot attempted using all usable fuel in the auxiliary tanks before switching the fuel selector to main tanks for landing (to avoid having unusable fuel in the auxiliary tanks in the event of an engine failure on approach). Mis‑timing the switchover could interrupt the fuel supply if the auxiliary tanks were exhausted. This would introduce air into the fuel lines, and manifest as struggling engines, such as observed by the witness. There was insufficient evidence to determine the likelihood that occurred.
In summary, based on the scenarios and fuel-related factors considered, it is possible to state that:
the fuel quantity when the aircraft departed either The Lakes or Toowoomba could not be determined but may have been sufficient to complete the return flight
the left engine lost power after its fuel supply was interrupted when approaching The Lakes
the right engine lost power due to a restriction to its fuel supply (it could not be determined if this was due to control inputs or otherwise)
at the end of the flight, there was probably less than 53 L usable fuel
it is unlikely that fuel was vented overboard due to incorrect tank selection sequence
it is possible that a fuel tank switchover was intended and mis‑timed.
Therefore, the ATSB concluded that the loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.
The occurrence
What happened
At about 1000 Eastern Daylight-saving Time[1] on 28 October 2017, a Cessna Aircraft Company[2] T310R, registered VH-JMW (JMW), departed The Lakes airstrip, New South Wales, for a private flight to Toowoomba Airport, Queensland with the pilot and one passenger on board. The aircraft arrived in Toowoomba at about 1130 and remained on the ground for a few hours.
At about 1437, the pilot and passenger departed for the return flight to The Lakes. The aircraft was not refuelled at Toowoomba and weather forecasts and reports indicated that conditions were suitable for flight under the Visual Flight Rules.[3] There was a light westerly crosswind at the cruising altitude of 9,500 ft and a light easterly wind at lower altitudes near the destination.
At about 1541, the passenger sent a cheerful text message to a friend, which indicated that all on board the aircraft was normal. A short time later, the pilot began the descent from 9,500 ft and continued tracking towards The Lakes.
At about 1554, a witness located close to JMW’s track heard a low-flying aircraft to the west of his position travelling south (Figure 1, ‘Witness 1’). He described the aircraft as sounding like a single‑engine aircraft and recalled hearing the engine ‘cough’ and then stop as the aircraft flew past him.
Figure 1: Flight path of VH-JMW
Source: Google Earth modified by the ATSB
A minute later, two other witnesses, both driving south along the Pacific Highway, saw JMW to the west of the highway at low altitude (Figure 1, ‘witnesses 2 & 3’). One witness recalled the aircraft was descending slowly at first with the landing gear extended. Soon after, the witness saw the aircraft ‘jerk’ then roll to the left, pitch down and descend rapidly to the ground.
At about 1555, JMW impacted trees and then collided with terrain. The aircraft came to rest in a narrow wooded strip of land between the highway and the main northern railway line (Figure 2). The wreckage was about 800 m (0.4 NM) from The Lakes runway 16 threshold.
One of the witnesses driving on the Pacific Highway was the first to arrive at the accident site. He recalled smelling fuel on arrival, and the ground around the aircraft’s wreckage being wet. He also noticed a momentary wisp of smoke from sparking electrical components behind one of the wings however, there was no fire. Emergency services personnel arrived at the accident site shortly afterwards. A couple of the first responders reported a fuel smell near the aircraft, but others did not recall smelling fuel.
The pilot and the passenger were fatally injured, and the aircraft was destroyed in the accident.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was participating in an air display as part of the City of Perth Australia Day Skyworks event. On board were the pilot and a passenger. The weather was fine with a recorded wind of about 20 km/hr from the south-west and a temperature of about 39 °C.
The pilot of CQA was flying ‘in company’ with a Cessna Caravan amphibian and conducted a series of circuits that included low-level fly-pasts of the Langley Park foreshore (Figure 1). After the second fly-past, the pilot of CQA commenced a third circuit, while the Caravan departed the area.
Figure 1: CQA air display flight track, showing the first fly-past in yellow, the second in magenta and the third in red
Source: OzRunways Pty. Ltd., modified by the ATSB
As part of the third circuit, the pilot of CQA flew in an easterly direction, parallel with the South Perth foreshore, before commencing a left turn. This would have facilitated a third pass in a westerly direction along the Langley Park foreshore. During the left turn, CQA rolled left and pitched nose down, consistent with an aerodynamic stall[1] (Figure 2). The aircraft collided with the water and broke up. The pilot and passenger were fatally injured.
Figure 2: CQA just prior to the collision with water (looking north)
Source: Mike Graham
The ATSB completed the on-site phase of its investigation on 4 February 2017. No pre-existing aircraft defects, which may have contributed to the collision with water, were identified. The ATSB has retained several items and components from the aircraft for further examination. This includes a fuel totaliser, a navigation unit and a mobile phone.
The investigation is continuing and will include:
examination of numerous witness reports and images and a significant quantity of video footage taken on the day by members of the public, media outlets and so on
review of the aircraft’s maintenance records, operational records for recent flights and pilot training records
review of the meteorological conditions at the time
an examination of aircraft performance and other operational factors
further examination of the recorded flight radar, radio and Global Positioning System data
review of the planning, approval and oversight of the air display, including a focus on safety and risk management practices.
Should any critical safety issues emerge during the course of the investigation, the ATSB will immediately bring those issues to the attention of the relevant authorities or organisations. This will allow those authorities and organisations to consider safety action to address the safety issues. Details of such safety issues and any safety action in response will be published on the ATSB website at www.atsb.gov.au.
Since the release of its preliminary report on 8 March 2017, the ATSB has provided an update to this investigation.
___________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was participating in an air display as part of the City of Perth Australia Day Skyworks event. On board were the pilot and a passenger. The pilot of CQA was flying ‘in company’ with a Cessna Caravan amphibian and was conducting operations over Perth Water on the Swan River, that included low-level passes of the Langley Park foreshore.
After conducting two passes in company, both aircraft departed the display area. The pilot of CQA subsequently requested and received approval to conduct a third pass, and returned to the display area without the Cessna Caravan. During positioning for the third pass, the aircraft departed controlled flight and collided with the water. The pilot and passenger were fatally injured.
What the ATSB found
The ATSB found that the aircraft aerodynamically stalled during a positioning turn for the third pass, resulting in the collision with shallow water. The manner in which the pilot returned to the display area after the second pass was not in accordance with the display procedures and increased the risk of mishandling the aircraft in an area of relatively close proximity to the public. The pilot’s decision to carry a passenger was also contrary to the requirements of the display instrument and increased the severity of the outcome.
Finally, a safety issue was identified with the current regulatory framework for air display approval and oversight.
What's been done as a result
The Civil Aviation Safety Authority had independently published a revised manual of guidance for air displays in September 2017. The document provided further detail on the key roles and their responsibilities and introduced a requirement to conduct a risk assessment as part of the application process. In April 2018, CASA updated the associated participant form, which was expanded to assist pilots with their display preparation and included a requirement to identify and provide justification for any additional persons on board display aircraft. The form also included a section to provide additional assurance around completion of the display coordinator’s responsibilities.
Finally, the ATSB has issued a safety recommendation to CASA to undertake further work to enhance their tools and guidance for air display approval and oversight, and procedures to ensure the suitability of those responsible for organising, coordinating and participating in air displays.
Safety message
Air displays are activities with inherent and unique risks that pilots, the organisers and the regulators all have responsibilities in addressing. It is important that holders of these key positions have a thorough understanding of their role and responsibilities, to ensure adequate completion of safety critical tasks. Having well-defined, transparent and consistent processes for planning and approval of air displays will assist in identifying risks and implementing effective mitigation strategies.
In addition to complying with regulations, pilots can limit their risk exposure by only participating in displays that are within their own and their aircraft’s capabilities and limitations, and not undertake any impromptu manoeuvres that have not been planned or practiced.
These steps combined will provide greater safety assurance for participants, spectators and the general public.
VH-CQA
Source: Flightaware.com
The occurrence
On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was preparing to participate in an air display as part of the City of Perth Australia Day Skyworks (Skyworks) event.
The pilot of CQA and a passenger arrived at Serpentine Airfield, 48 km south of Perth (Figure 1), at about 1500 Western Standard Time,[1] to prepare the aircraft for flight. The pilot was reported to have used his mobile phone to discuss aircraft performance with another individual and subsequently unloaded some equipment to reduce the aircraft’s weight. At about 1625, once the pilot had confirmed via phone the take-off calculations for the runway length and local temperature of about 42˚C, he and his passenger, who did not have any pilot qualifications, boarded CQA.
The pilot was in the left seat and the passenger in the right seat. CQA departed from runway 23 and tracked out towards the coast. The pilot of another aircraft returning to Serpentine Airfield observed CQA’s departure and described it as a ‘long and slow climb’, which they surmised was due to a combination of the high ambient temperature and the aircraft’s inherent performance.
The pilot of CQA planned on flying ‘in company’ (see the section titled Procedure for fly‑bys) with a Cessna Aircraft Company C208 ‘Caravan’ amphibian, registered VH-MOX (MOX) during the air display. The pilot of MOX received a text message from CQA’s pilot, advising that he would not be landing at Jandakot Airport as previously discussed and requested that they meet up overhead the agreed alternative location of Cockburn Sound (Figure 1). MOX departed from Jandakot at about 1645 and met up with CQA over Cockburn Sound.
Upon meeting up, the pilot of CQA assessed that MOX’s speed was too high for the two aircraft to travel together and requested that the Caravan pilot slow his aircraft down. The pilot of MOX agreed to slow down with a request that CQA ‘didn’t get too close’. Both aircraft then flew the prescribed route to Perth Water, the location of the air display. The weather was fine with a recorded wind of about 20 km/h from the south-west and a temperature of about 39°C.
Figure 1: CQA and MOX flight path
Source: Google Earth, modified by ATSB
Once approved to enter the display area, CQA followed MOX via the prescribed inbound route to the north of Perth city in order to conduct a fly-by parallel to the Langley Park foreshore in a westerly direction (Figure 2). MOX conducted a splash‑and‑go[2] in front of Langley Park while CQA followed at about 200 ft above the water. The delay associated with MOX’s splash-and-go resulted in the separation between MOX and CQA reducing. MOX lifted from the water surface, entered a climbing turn and conducted a left orbit[3] within the confines of Perth Water to reposition for a second pass of Langley Park.
Flight data and video footage showed that CQA took longer to initiate the left orbit and subsequently flew at about 500 ft over the built-up area of the South Perth peninsula that connects to the Narrows Bridge, at the western end of Perth Water. CQA then descended to about 200 ft over the south of Perth Water while repositioning for a second pass.
Figure 2: CQA air display flight track, showing the first pass in yellow, the second in magenta and the third in red
Source: Google Earth, modified by the ATSB
When MOX conducted its second splash-and-go in front of Langley Park, CQA was about half an orbit behind, flying in an easterly direction along South Perth foreshore. Following completion of the splash‑and‑go, the pilot of MOX climbed over the Narrows Bridge to about 1,000 ft for the return flight to Jandakot. CQA’s second fly-by of Langley Park was lower than the first, descending to just above the water surface, before a climb was also initiated to clear the Narrows Bridge.
On departure from Perth Water, the pilot of MOX transmitted on the display frequency that he was exiting the display area and returning to Jandakot Airport. CQA flew over the Narrows Bridge and initially followed MOX toward Jandakot, during which time the pilot requested approval to conduct a third pass. This request was authorised via radio by the ‘Ringmaster’,[4] but as the pilot of CQA did not hear the authorisation, MOX re‑transmitted the approval to CQA, while continuing with their own departure. CQA then conducted a left turn and returned directly to Perth Water, at about 300-400 ft over the built-up area and moored spectator boats.
CQA flew in an easterly direction, parallel with the South Perth foreshore, before commencing a left turn towards Langley Park to position for the third pass. The aircraft was at a similar altitude to the first orbit at the commencement of the turn, but was slower and positioned further towards the middle of Perth Water (Figure 3). Video and still imagery recorded that the wing flaps were in the retracted position. The left turn was tighter than that of the first orbit and during that turn, CQA rolled left and pitched nose-down, consistent with an aerodynamic stall[5] (Figure 4). The aircraft collided with the water and was destroyed. The pilot and passenger were fatally injured.
Immediately after the accident, the remainder of the air display was cancelled, followed shortly after by cancellation of the entire Skyworks event.
Figure 3: CQA's pass along South Perth, just prior to the final left turn
Source: David Roses
Figure 4: CQA just prior to the collision with water (looking north)
The pilot held a Private Pilot (Aeroplane) Licence issued in July 1994, and a current Class 2 Aviation Medical Certificate. His endorsements included floating hull, manual propeller pitch control and retractable undercarriage, and he held single- and multi-engine ratings. The pilot completed his floating hull endorsement in October 2011 on a LA-4-200 Lake Buccaneer Amphibian. In 2012, he completed about 18 hours of flight training[6] in the Grumman American Aviation Corp G-73 Mallard (Mallard) in the United States, under his Federal Aviation Administration (FAA) licence.
The pilot accrued about 21 hours on VH-CQA (CQA) between 6 and 13 January 2017. Prior to that, he had not flown any aircraft since 29 August 2016. The pilot conducted no further flights until 26 January 2017. At the time of the occurrence, the pilot’s logbook indicated that he had 625 hours flying experience, with about 180 hours in the Mallard.
The pilot had accrued 136 water landings, of which 84 were completed over the two days of his floating hull endorsement. The pilot’s Mallard water landing experience consisted of 37 landings during dual training and 11 while solo. The pilot’s most recent water landing (which was in CQA) was conducted on 28 February 2016.
Post‑mortem examination and toxicological analysis of the pilot and passenger did not identify anything that may have contributed to the accident.
Mallard rating and flight reviews
The pilot’s Mallard training in the United States, was completed on 25 May 2012 and was conducted on the same aircraft that was later registered as VH-CQA (see the section titled Aircraft information). The pilot’s log book was endorsed as ‘training completed’ and ‘unrestricted land and sea use of the G73’ and he commenced flying the Mallard solo, in Australia on 30 July 2012.
Due to an administrative error during conversion of the pilot’s United States flight crew licence, his Civil Aviation Safety Regulations (CASR) Part 61 licence was not issued with a G-73 rating. This was identified by the Civil Aviation Safety Authority (CASA) during the air display application process. The pilot applied for the G-73 rating on 19 January 2017 and his licence was reissued with the type rating on 24 January 2017.
CASA Instrument 186/14 published on 25 August 2014, introduced prescribed aircraft, ratings and variants for the CASR Part 61 licencing system. On 23 December 2014, CASA published Prescription of aircraft and ratings– CASR Part 61, identifying those aircraft considered sufficiently complex or having performance or handling techniques that warranted initial specific training and per-type flight reviews. Schedule 6 of this document identified the Grumman G‑73 Mallard as a type-rated aircraft.
The pilot’s most recent biennial flight review was conducted in April 2016 in a Piper PA-30 Twin Comanche. The flight review prior to that (April 2014) was also conducted in the PA-30. An exemption to CASR Part 61, EX97/16, allowed for a multi-engine aeroplane class rating flight review to satisfy the flight review requirement for a type-rated multi-engine operation. The pilot therefore satisfied the flight review requirement to fly the Mallard, but had not had a review in the aircraft type since his endorsement.
Despite the exemption, all pilots were subject to the CASR 61.385 ‘general competency rule’, which indicated that a pilot is only authorised to fly an aircraft if they are competent to the standards mentioned in the CASR Part 61 Manual of Standards. Outside of the requirement for flight reviews, the pilot was responsible for ensuring his competence to fly the aircraft.
The instructor who provided the pilot’s floating hull endorsement training flew with him again in April 2015, this time in the Mallard. He recalled the pilot as being ‘generally pretty good’, but that he ‘wasn’t quite up to speed with the aeroplane’ and suggested that this may have been due to the pilot’s irregular flying.
Air display experience
The pilot participated in several air displays whilst flying CQA, including the:
Great Eastern Fly-In (GEFI) events at Evans Head Aerodrome in New South Wales in 2015, 2016 and 2017.
Brisbane Valley Air Show (BVAS) at Watts Bridge Memorial Airfield, Queensland in 2016.
The programs for these events indicated that the pilot demonstrated a ‘handling display’. Review of video footage showed that the displays included one or more straight and level fly-bys with repositioning turns for return passes.
The pilot’s application to take part in the Perth air display described the proposed display as ‘same display as used previously at GEFI and BVAS, minimum height 300 ft, no aerobatic manoeuvres, multiple passes, no ‘dirty pass’,[7] all within normal operating manual’.
Familiarity with the Perth Water air display area
On 13 January 2017, during CQA’s repositioning from New South Wales to Western Australia, the pilot undertook a flight from Esperance to the north of the Perth metropolitan area and then tracked south along the coast before turning inland, toward Perth city. During this time, the aircraft flew in an easterly direction along the Langley Park foreshore at about 1,000 ft, before turning right prior to the Causeway Bridge (Figure 6). CQA was then flown in a westerly direction toward the south Perth peninsula, where the aircraft tracked toward Fremantle, then down the coast toward Serpentine Airfield. The pilot did not fly CQA again until the air display on 26 January 2017.
Aircraft information
The Grumman American Aviation Corp G-73 Mallard is a high-wing, medium-sized amphibious aircraft[8] with under-wing floats, retractable landing gear and two-step hull (Figure 5). It was powered by twin Pratt & Whitney R-1340 Wasp radial engines. The Mallard was designed for regional airline operations with two pilots and ten passengers. Fifty-nine aircraft were built between 1946 and 1951.
Mallard serial number J-35 was built in 1948 in the United States and was first registered in Indonesia that same year. In 1976, the aircraft was relocated to the United States and operated there before the occurrence pilot purchased it and transferred it to Australia in July 2012. The aircraft was then based at Evans Head Airfield, New South Wales.
Figure 5: VH-CQA
Source: David Roses
The aircraft flew in Australia under its United States registration until it was re‑registered as VH‑CQA (CQA) in July 2013. In August 2013, CQA was issued with a Special Certificate of Airworthiness in the Experimental – Exhibition category with defined operating requirements. This included that any passengers were to be made aware that the design, manufacture and airworthiness of the aircraft was not required to meet any standard recognised by CASA and that flight in the aircraft was at their own risk. In addition, warning placards detailing this information were to be placed in full view of all passengers.
Flight characteristics and performance considerations
The ATSB sought the input of two experienced Mallard pilots and a CASA-authorised flight analyst in order to gain appreciation of the flight characteristics of the Mallard and its performance considerations. It was commented that the Mallard could easily be operated by one pilot. However, it was also mentioned that because it has a constant-angle, high performance wing[9] it ‘requires more care than with a wing that provides more lift at a slower speed’, particularly as a stall can result in the aircraft going ‘straight onto its back’.
Maintenance history
CQA was maintained in accordance with a CASA-authorised System of Maintenance (SOM). This SOM was effective as at May 2013 and the aircraft was required to undergo a conditional ‘periodic’ inspection every 12 months or 100 hours, whichever came first. CQA was maintained by a CASA-authorised maintenance provider, who conducted a periodic inspection and issued the current maintenance release, on 6 January 2017. At the time of the accident, the aircraft had accumulated about 22 hours since that periodic inspection and had a total time in service of 7,336 hours.
As CQA was reportedly being relocated to Western Australia, the maintainer released the maintenance log books to the pilot. However, they could not be located following the accident and the maintenance history could therefore not be reviewed by the ATSB. Information from CASA and other sources did not identify evidence of any previous accidents involving the aircraft.
An installed autopilot was removed from CQA as part of Supplemental Type Certificate SA635SO, prior to its delivery to Australia. Removal of that equipment reduced the maximum certificated take-off weight to 5,700 kg. The aircraft flight manual authorised the G‑73 for single-pilot operation[10] and CQA’s instrument panel was set up for left-seat, single-pilot operations.
CQA was not fitted with a stall warning device[11] and there was no requirement for one.
VH-MOX and flight crew information
VH-MOX (MOX) was a Cessna Aircraft Company 208 ‘Caravan’ that was manufactured in 1993 and first registered in Australia in 1994. The Caravan is an all-metal, high-wing aircraft that is powered by a single Pratt & Whitney PT6A turboprop. MOX was fitted with floats with retractable landing gear to allow for land and sea operations. The Caravan had a maximum take‑off weight of about 3,600 kg.
The flight crew of MOX consisted of the pilot in command (PIC), in the left seat, and an observer, in the right seat. The PIC held a current instrument and Grade 1 instructor rating and had extensive float experience operating Caravans. The PIC also had commercial Caravan operations experience within Perth Water and had operated the aircraft there in the week prior to the air display. In addition, the PIC had previous experience participating in the Perth Air Display.
The observer was a pilot with significant experience in float planes and floating hull aircraft, at Perth Water and other locations. He held a Grade 1 instructor rating and had over 27,000 hours flying experience. In addition, he had previous air display experience in light aircraft. Both pilots had low-level endorsements, with recent experience, and had flown with each other previously.
Meteorological information and water conditions
The Bureau of Meteorology reported the weather conditions for 26 January 2017 were ‘fine, very hot and sunny’ with temperatures reaching 42˚C in the Perth area[12] during the day. Perth Airport records for 1500 indicated the temperature was 41.5˚C with a relative humidity of 9 per cent. Wind speed and direction recordings from nearby Melville Water indicated a wind speed of about 11 knots from 226˚ (20 km/h from the south‑west). Pilots in the air display described the water condition as ‘ideal’, not glassy, with small ripples to assist with depth perception and wind direction identification.
The sun was low in the sky to the west and was unlikely to have affected the pilot’s visibility immediately prior to the collision, when the aircraft was flying east and then turning north.
Recorded data
Analysis of available track data (as depicted in Figure 2) found that the Mallard’s speed on entry to the accident turn was approximately 10 kt slower than at the equivalent point in the previous orbit and within around 10 kt of the aircraft’s stall speed for a coordinated turn at an estimated 30° angle of bank at the commencement of the turn.
Site and wreckage information
CQA collided with water on the Swan River, in a shallow section, approximately mid-way between the Langley Park and South Perth foreshores and about 700 m west from The Causeway. A navigable channel had been dredged parallel with the Langley Park foreshore, the remainder of Perth Water was relatively shallow, with a layer of silt. The mostly‑submerged wreckage was recovered and transported by barge to a nearby secure facility for technical examination.
Damage to the aircraft was consistent with the observed collision with water in a steep nose-down attitude and subsequent contact with terrain, about 1.5 m below the surface. Examination of the wreckage did not identify any evidence of in-flight break‑up, component failure or other anomalies that may have contributed to the collision with terrain, or that would have prevented the engines and propellers from operating normally. This was consistent with witness reports, images and video of the aircraft during the display.
Conduct of the air display
Overview
The City of Perth (CoP) managed the Australia Day Skyworks (Skyworks), which consisted of a series of events on 26 January each year, culminating in a fireworks display from barges moored in the centre of Perth Water (Figure 6). Perth Water is located on the Swan River between Langley Park and the South Perth shoreline, the Narrows Bridge in the west and Causeway in the east. Events included various activities on the Langley Park foreshore and the South Perth foreshore, which was coordinated by the City of South Perth. Water-based events and the air display were managed on behalf of CoP by a contracted events management company. Up to 300,000 people attended each year.
The air display had been a part of the Australia Day activities since 1993. The event was originally organised by an individual, then through the Royal Aero Club of Western Australia, before being incorporated into the CoP’s overall management of the event.
The air display was scheduled to run from 1530 until 2000, before the commencement of the fireworks display. The programme consisted of fly-bys (small vintage aircraft, like Tiger Moths, through to a medium-sized Fokker 100 jet), individual and group aerobatics, banner/flag-towing, aerial displays from water-bombing aircraft and float plane ‘splash-and-go’s’. The participating pilots were mostly volunteers, many of whom had been associated with the event for many years. Several of the pilots also participated in multiple displays on the day.
Figure 6: Perth Water
Source: Google Earth, modified by ATSB
Airspace
Perth Water is located about 10 km west‑south‑west of Perth Airport, in class C airspace. A temporary danger area (TDA)[13] ‘Area ALPHA’ (Figure 7) was established by Airservices Australia for the duration of the air display, from surface up to 1,500 ft AMSL.[14] This allowed air display aircraft to operate in Perth Water without the need for specific air traffic control (ATC) clearance. A central point of contact ‑ the Ringmaster ‑ was required to maintain two-way communication with Perth ATC and coordinate aircraft access into Area ALPHA on a specified frequency. Standard airspace procedures were required for operations outside of Area ALPHA.
Figure 7: Google Earth image showing approximate location of Perth Water within Area ALPHA.
Source: Google Earth, modified by ATSB
Air display program and procedures
The CASA-approved air display program documented all participating aircraft, flight crew and routines for the display. Where a routine involved multiple aircraft, one aircraft was designated the ‘lead’ aircraft and would conduct all radio communications on behalf of the group. Each display was scheduled in 10‑15 minute time slots. The display program was often similar to the year before, depending on availability of aircraft. All pilots taking part in the air display were provided with briefing notes, which included a copy of the CASA approval, airspace procedures, air display program and standard display procedures.
Inbound, holding and outbound tracking
The procedures for approach and departure from the display area were detailed in ‘display procedure B2’ (Figure 8). Once aircraft had entered Area ALPHA they were to track toward the holding area XRAY at an altitude of 1,500 ft (D1 INBOUND OUTBOUND HOLDING). If holding was required, aircraft would perform right orbits until they were given clearance by the Ringmaster to track inbound to Perth Water. Unique displays, including aerobatics, entered Perth Water in accordance with their documented routine.
For all non-aerobatic aircraft, the standard inbound route to the display area (Perth Water) was to fly over Kings Park then Northbridge (to the north of Perth City) and via the Graham Farmer freeway toward the East Perth power station (D2 INBOUND DISPLAY AREA). Aircraft descended to 1,000 ft while flying over the Swan River toward the Causeway and Perth Water. Departure from the display area was via the Swan River at 1,000 ft toward Fremantle, until clear of Area ALPHA.
Figure 8: Extract of the CASA‑authorised B2 display procedure supplied to all participants
Source: CASA
Procedure for fly-bys
Fly-bys (procedure D3, Figure 9) were to be performed by groups of aircraft flying ‘in formation’ or ‘in company’. The program noted that ‘formation rated and current pilots [are to] only [fly] in formation groups up to maximum of 6. Other aircraft [including those operating in company] were to maintain 600 metre separation between each other’.
Figure 9: Extract from the ‘display procedures – B2’ diagrams, showing the arrow that indicates the direction and location of the float plane landing area
Source: CASA
Following the standard approach and departure procedure, aircraft conducting fly-bys were to descend from 1,000 ft to not below 500 ft over the channel of water between the pyrotechnic barges (red rectangle, Figure 9) and Langley Park foreshore. The aircraft were to depart over the Narrows Bridge (Figure 6) and track over the Swan River at 1,000 ft, back toward Jandakot Airport.
If additional fly-bys were approved by the Ringmaster, there were two options to re-enter the D2 ’inbound display area’ procedure:
aircraft could turn right before Kings Park and fly along the freeway on climb to 1,500 ft and re‑join the D2 procedure at the western end of Northbridge, or;
from the Narrows Bridge they could track along the Swan River and fly over Kings Park on climb to 1,500 ft, before re-joining the D2 procedure at Northbridge.
The standard D3 procedure was to be followed for the remainder of any additional fly-bys. Between one and three fly-bys, per display, had been the standard in preceding years. Fly-bys and multiple passes were not specifically detailed with respect to the float plane procedure.
Procedure for float planes
Float planes had been part of the air display in the past, but not every year. Previous float plane displays had included the Cessna C208 Caravan, a Cessna 206 and a Lake Aircraft LA-4-200 Buccaneer.[15] The display coordinator (DC)[16] advised that float planes were added to the air display about 10 years prior to this accident. A representative from CASA observed him demonstrate the intended display in a Cessna 206, before they were approved for inclusion in the display program. The C208 Caravan was the most frequently used aircraft type for this display.
Within Perth Water, the float planes were permitted to descend to the water surface. On some occasions they had landed and back-tracked before turning around and taking off. However, it was reported that when conditions were suitable, float planes were expected to conduct a splash‑and‑go, remaining on the step.[17] The C208 Caravan float plane procedure submitted to CASA for 2015 and 2017 was essentially the same and is shown in Figure 10.[18]
Figure 10: Float plane procedure approved by CASA in 2015 and 2017
Source: CASA
A procedure for the Mallard was added to the float plane procedure for the 2017 air display and included ‘touching the water the same as above [the C 208] but without getting off the step’.
Both the floatplane and flying boat procedures contained a contingency to conduct a missed approach while remaining in the display area if water and wind conditions were not suitable. Both procedures also made reference to ’approach…per standard bridge clearance procedure’. There was no reference to what this procedure was, but it was assumed by the ATSB to be the standard approach and departure (B2) procedure.
The B2 display procedure included the ‘D6 Floatplane Landing’ (Figure 9) location at the northern edge of the display box.
Actual conduct of the float plane display
When the float plane display was first introduced, the aircraft would usually land, back-track and then take off. While not documented, the sequence was subsequently altered to a splash-and-go, followed by the left orbit. That variation had reportedly been in place for a number of years.
The float plane procedure in practice was therefore to approach from behind the city to enter Perth Water, conduct a low pass (or splash‑and‑go) at the northern edge of the display box, followed by a left orbit within the confines of Perth Water, before conducting a second pass along the Langley Park foreshore. The float planes would then depart as per the standard procedure or conduct a second left orbit if they were going to do a third pass/splash‑and‑go.
This sequence was consistent with the display briefing given the night before the activity, where the float plane display was described by the DC as follows:
The float planes… will be doing their touch and go…but they won’t be landing fully. If anything they [are] just kissing the water and then do an orbit and then another one and then [depart].
Further, video footage of the briefing showed the DC indicating left orbits on the projected map at this time.
CASA’s understanding of the float plane display sequences
CASA personnel who approved the display advised that they were not aware left orbits within the confines of Perth Water were being conducted during the float plane display. They reported having an understanding that:
the float planes would conduct the standard approach from behind the city
perform one low pass, or splash-and-go
depart via the standard procedure.
They further stated that had they known left orbits were being conducted, they would not have approved a ‘turn into that area in a Caravan, let alone a much larger aircraft’.
The DC advised he had not mentioned the left orbits to CASA as they had never specifically enquired about the float plane sequence. However, CASA staff were present for the briefing conducted the night before the activity, in which the conduct of orbits was described.
Operation within Perth Water
The ATSB spoke with Caravan and Buccaneer float plane pilots who had experience operating within Perth Water and were therefore familiar with the display area. They noted that their aircraft did not have a lot of room to manoeuvre and described Perth Water as a ‘confined’, ‘constricted’ and ‘very tight operating area’.
Air display conditions for conducting the display in Perth Water were captured in the display instrument, and included that:
Non-aerobatic display aircraft are not to be operated below 1.3 times the stall speed for the aircraft’s configuration.
…display aircraft will pass no closer than 200 metres horizontally from spectators. Aircraft below 1500 feet AGL shall not track or manoeuvre directly towards spectators within a horizontal distance of 500 metres.
For aircraft operated by pilots holding a low-flying approval, the demonstration may be conducted with the following manoeuvring limitations:
a) Between 50-200 feet AGL – wings level only
b) Between 200-300 feet AGL – up to 30 degrees angle of bank
c) Between 300-500 feet AGL – up to 60 degrees angle of bank
Despite the differences in understanding of the intended display between CASA and the display participants, and the stated effect on the display approval, the ATSB determined that it was possible to conduct orbits in the Mallard, while adhering to the display conditions, however there was little room for error. A similar conclusion was reached by CASA in their post-occurrence regulatory safety review.
However, following review of the draft investigation report, CASA advised that the conduct of orbits within Perth Water could not be conducted in compliance with Civil Aviation Regulation (CAR) 157. Despite this, the ATSB noted that CASA did approve the conduct of essentially identical manoeuvres in the form of a ‘…go around whilst remaining in the display area’, per the display procedure.
Approval of VH-CQA in the air display
The DC met the pilot of CQA in late 2016. In early 2017, when he became aware the aircraft was coming to Western Australia, he invited the pilot to participate in the air display. In January 2017, leading up to the air display, the following key interactions to facilitate participation of the aircraft and pilot occurred:
In an email to CASA on 4 January that included documents for the air display application, the DC mentioned the possibility of CQA being involved in the display. The display procedures submitted in this email included one for ‘flying boat’. He also provided details for several display pilots, including the pilot of CQA.
On 11 January, the DC advised CASA via email that another float plane had been added to the program to fly with CQA. However, a revised procedure detailing this new aircraft was not included in this email.[19]
On 12 January, CASA asked the DC if the pilot of CQA was going to get an opportunity to practice prior to the event. He replied that it would be the same as ‘all other displays where pilots will prepare appropriately’, and that he would meet with the pilot of CQA when he arrived in Perth. CASA then requested the pilot of CQA provide a statement in relation to the water depth in the proposed landing area, for the appropriate date and time of the event. The DC replied there would likely be a water depth of about 1 m.
On 16 January, the DC sent an email to the pilot of CQA where he offered to be ‘co-pilot’ during the display, to ‘help with the radio and procedure’.
In an email to CASA on 17 January, the DC indicated that he had spoken with the pilot of CQA and agreed that he would only do a splash-and-go and that the aircraft would not get off the step.
During a phone call on 19 January, the DC was advised by CASA that the pilot of CQA would not be able to participate in the air display without the required G-73 type rating being endorsed on his licence. The DC advised the pilot of CQA of the issue with the type rating via email and that CASA had agreed to wait until midday 23 January when, if no evidence of this type rating was provided, CQA would be withdrawn from the program.
About a week before the air display, the DC arranged with CASA for MOX to be included in the display and submitted details for the pilot and advised that he was still waiting for confirmation that CQA could participate. The email advised that the pilot of MOX had been in the display three years previous and had ‘done this very sequence’, described as being ‘fly by + touch and go on water’.
On the evening of 23 January, the DC submitted a revised float plane display sequence showing details solely for the Caravan. The Instrument (the approval - the term Instrument is discussed in the section CASA approval and oversight of air displays) was sent to the DC at 1940 that evening.
On the afternoon of 24 January, the DC emailed CASA with documents showing that CQA’s pilot now held the required G-73 type rating and an ‘authority to fly letter’ from CASA. He also requested that CQA now be included in the display. He also submitted the float plane display sequence including the Mallard and the Caravan and a revised program, which now showed CQA and MOX. In his email to CASA, the DC also stated that as a member of the CASA team had reportedly had a concern about the ‘first time [participation of a new pilot and aircraft type]’, he would ‘go along to be of support [to the pilot] for the procedure which should mitigate against that concern’. Revision 2 of the Instrument was issued by CASA that evening.
Risk mitigation
CASA personnel reported that they approved the inclusion of CQA on the basis of having the DC on board, to mitigate against the risk associated with having a new pilot and aircraft type involved in the display. CASA’s documented reason for allowing CQA to participate in the display referred to the email received from the DC on 24 January (detailed above), indicating that he would be on board.
The DC reported that he originally offered to be on board to assist the pilot with any procedural aspects associated with his first time in the display. However, he indicated that having CQA follow MOX for the display effectively mitigated that concern. He also indicated that his offer to be on board CQA was not acknowledged by CASA and there was no indication that this was their expectation. Therefore, he believed his presence on board was not a requirement. Additionally, the pilot elected to depart from Serpentine Airfield, rather than the original Jandakot Airport departure point. As the DC was a participant in five displays that day, he would not have had the time to travel to Serpentine in order to be on board.
As part of their post-occurrence regulatory safety review (see the section titled CASA approval and oversight of air displays section) of the lead-up and conduct of the air display, CASA identified that despite their expectation that the DC would be on board CQA, they had not specifically advised the DC of this, nor was this requirement included in the Instrument of approval. CASA also did not advise the pilot of CQA that the DC being on board was a requirement for his inclusion.
Pre-display briefing and flight planning
The CASA air display guidance manual (see the section titled CASA approval process for air displays) detailed that a written brief of the flying program should be circulated in advance of the air display, to pilots and those in other critical roles. In addition, ‘a formal verbal briefing should be given on the day of the display and at any rehearsal, and all participants, where possible, must attend’. Those not able to attend were to be verbally briefed separately. The manual listed the minimum items that were to be covered in the briefing.
The Skyworks pre-display briefing was held at Jandakot Airport the night before the event. All air display participants were required to sign Form 695 Participant signature sheet, acknowledging that they have read the CASA approval for the air display and would operate their aircraft in accordance with the terms of the approval. The briefing was conducted by the DC in a large cafeteria-style room, with participants seated at various small tables. The Ringmaster and CASA also addressed the participants. The event was video recorded by the City of Perth and the footage[20] was reviewed by the ATSB. Participants were seen reviewing copies of the written brief, which had been provided to them at the commencement of the briefing.
The briefing included a discussion of the display area, air space, radio communications and standard approach, holding and departure procedures. As detailed previously, the extent of the float plane-specific brief was, ‘the float planes… will be doing their touch and go…but they won’t be landing fully. If anything they [are] just kissing the water and then do an orbit and then another one and then [depart]’. The DC also discussed the importance of aircraft serviceability, the anticipated weather conditions, considerations about personal fatigue and to ‘have your own risk management’. He also emphasised that they were the lead-up to the main event and there was ‘no pressure to do anything special’, ‘just do everything as you normally do, don’t do anything different’ and to ‘have your own limitations’. The DC reported that separate ‘formation’ briefs were conducted for participating pilots on the morning of the air display, prior to departure from Jandakot Airport.
The pilot of CQA attended the briefing, where he first met the pilot and observer of MOX. The pilot of MOX reported that:
he and the pilot of CQA discussed airspeeds, who would lead and who would be on board CQA
it was arranged that the two aircraft would meet at Jandakot Airport (where CQA could refuel and/or collect the DC) or overhead Cockburn Sound (if CQA flew directly from Serpentine Airfield)
MOX would be the lead aircraft, handle the radio calls and general procedures, so that CQA could follow.
The pilot of MOX reported that he did not have any expectations of CQA’s pilot, other than CQA would follow MOX. He recalled that the pilot of CQA had suggested he would not touch the water, but conduct a low overshoot. On the day of the display, the pilot of MOX received a text message from the pilot of CQA at about 1515, advising he would meet MOX overhead Cockburn Sound.
Carriage of passengers during the air display
Civil Aviation Regulation (CAR) 2 Interpretation defines a ‘crew member’ as a person assigned by an operator for duty on an aircraft during flight time and ‘operating crew’ as any person who:
• is on board an aircraft with the consent of the operator of the aircraft; and
• has duties in relation to the flying or safety of the aircraft.
CASR Dictionary – Part 1 – Definitions describe the following roles:
Flight crew member means a crew member who is a pilot or flight engineer assigned to carry out duties essential to the operation of an aircraft during flight time.
Passenger, in relation to an aircraft, means a person:
(a) who:
(i) intends to travel on a particular flight on the aircraft; or
(ii) is on board the aircraft for a flight; or
(iii) has disembarked from the aircraft following a flight; and
(b) who is not a member of the crew of the aircraft for the flight.
Under Civil Aviation Order 29.4 Air Displays, one of the conditions of approval to conduct an air display is that ‘passengers shall not be carried for hire or reward during any part of the air display except where specifically approved as part of the program’. While this did not exclude the carriage of passengers for no compensation, the CASA instrument of approval for the 2017 Skyworks air display was more explicit, stating that ‘passengers shall not be carried in display aircraft and only aircrew essential to the operation of the aircraft are to be carried’. Similarly, the following statements were included in the Flight Crew section of the air display manual:
No persons other than operating crew may be on board a civil aircraft during the air display unless the prior written permission from CASA has been obtained.
The responsibility for ensuring that an aircraft is operated in accordance with its Certificate of Airworthiness, Permit to Fly and Air Display Approval rests with the pilot in command. This does not absolve the Display Organiser from the responsibility to take such action as is necessary should a display aircraft deviate from the bounds of any approval or operate in an unsafe manner.
In addition to the regulatory considerations above, as part of the pre-display briefing the DC reinforced that ‘you’re not allowed to carry passengers but you are allowed to carry operational crews’.
During discussions following the pre‑display briefing conducted on 25 January 2017, the DC was made aware that the pilot of CQA intended to have an additional person on board, in the right front seat. The pilot had mentioned to several people that it was necessary for this person to be on board CQA to assist in the case of needing to manually deploy the main landing gear. The Mallard’s flight manual did not include this method for releasing the main gear and other Mallard pilots reported being unaware of it.
This reasoning was also raised by the pilot when questioned by CASA officers after they witnessed two people disembark the aircraft during CQA’s participation at the Great Eastern Fly-In events at Evans Head Aerodrome, New South Wales on 7‑8 January 2017. The outcome of that conversation was that the CASA officers informed the pilot that his passenger did not meet the definition of essential crew.
The CASA officers that participated in the discussion at Evans Head were from the sport aviation office and were not aware of the pilot’s application to participate in the Perth Air Display. The Perth office was similarly unaware of the discussion that had taken place at the Evans Head event when they assessed the pilot’s application for the Perth display.
The pilot’s logbook indicated that his passenger had flown on CQA several times, between 6‑13 January 2017 and had a total time on board CQA of about 19 hours. While it was reported that the passenger was interested in flying training, information received from CASA and the National Transportation Safety Committee (NTSC), Indonesia found that she had not registered with either organisation and did not hold a flight crew licence.
It was also reported that the pilot had invited another person to be on board during the Skyworks display. However, the pilot’s decision to minimise the weight of the aircraft due to the temperature on the day, prior to departure from Serpentine Airfield, resulted in that person not being on the accident flight.
Following a recommendation from their regulatory safety review conducted after this accident, CASA published a revised Form 697 Pilot or essential crew details in April 2018. This expanded form added a checklist of considerations for display pilots in relation to their intended display. Sections were also included to allow for identification and reasons for the requirement of additional crew and a DC checklist to ensure consistency in the application. In addition, this form was now required to be signed by the pilot, crew (if applicable) and the DC.
Air display roles and responsibilities
Documented roles and responsibilities
CASA’s Air Display: Safety and Administrative Arrangements manual (air display manual) provided guidance on the minimum safety and administrative procedures necessary to run an air display. The manual included a list of key personnel and their responsibilities, most notably, that of the Display Organiser, Display Coordinator and flight crew (Table 1).
Table 1: CASA Air Display Administration and Procedure Manual[21] terminology of air display roles
Display Organiser (DO)
The air display ‘organising body must appoint one person as the DO to assume overall responsibility’. This person is also expected to be ‘personally familiar with each pilots’ display routine and ensure that it complies with the safety criteria’. They are responsible for the planning and display management, including:
appointment of DC, flying display committee, officials and flight crew
site assessment
marking of the display axis
pre-display briefing
document checks
pilots’ display programs (both normal and weather-restricted programs).
Where the DO does not have ‘considerable aviation experience’, they are to appoint a ‘suitably qualified person, preferably with display experience, as the DC.
Display Coordinator (DC)
The DC is ‘sometimes referred to as the Ringmaster because he/she controls the actual flying program’.
The DC’s responsibilities included:
flying discipline in general
compilation, approval and modification of individual flying routines
the overall flying program
cancellation or modification of the flying program in the event of unsuitable weather or other such conditions.
‘It is strongly recommended that, before being appointed as a DC, the DC should have had the experience of being an Assistant DC or being in a similar subordinate role in at least one Air Display of similar complexity.’
Flight Crew
The pilot in command’s responsibilities included:
ensuring the aircraft is operated in accordance with its certificate of airworthiness and the air display approval
planning their flying sequence to maintain minimum separation distance from the crowd line.
During the pre-display briefing, the pilots were to be reminded ‘that flying over the crowd, car park or any public enclosure is prohibited and any turns towards these areas must be completed without infringing the safety buffer between the display axis and the crowd line’.
The CASA-issued instrument granting approval for the 2017 air display assigned the City of Perth to the role of ‘Display Operator’ and separate individuals to the roles of DC and Ringmaster. The instrument did not assign a DO.
The role of Display Operator was not defined in the air display manual, however they, along with the DC, had a responsibility via the instrument to ensure that the display was conducted in accordance with the relevant legislation.
Recognising the discrepancy between the roles defined in the air display manual and the instrument, the role titles identified in the CASA‑issued Perth air display instrument are used throughout this report for consistency.
Display Coordinator
During the 2017 display organisation and approval, the DC carried out some of the responsibilities of that role, as well as that of the DO, per the air display manual. When interviewed by the ATSB, members of the CASA team referred to the same individual as both the DO and DC. It was noted that this was possible in accordance with the manual.
The DC held an Air Transport Pilot (Aeroplane) Licence and a Commercial Pilot (Helicopter) Licence, for single- and multi-engine aeroplanes and single‑engine helicopters. He held multiple design feature endorsements including floating hull and float plane. The DC was endorsed for aerobatic flight activities and held low-level ratings for both aeroplanes and helicopters.
The DC had been involved as a pilot in the Perth Air Display since its inception and over time voluntarily took on various roles with respect to planning, procedures and approvals. He was directly involved in developing the display program and conducting the pre-flight brief, typically the night before the event. He advised that on the day of 26 January each year, ‘I’m just a display pilot… just like all the other pilots participating in the displays’. The DC advised that responsibility for ensuring the display instrument was being followed on the day of the event was with the Ringmaster.
The DC self-identified as the ‘air display liaison’ which was also reflected on the Airservices Australia letter of agreement (airspace arrangement) and the City of Perth Skyworks emergency contact list. Despite this, the DC had entered his name as DO on the 2015, 2016 and 2017 application forms.
With regard to the approval process, the DC reported that different CASA officers had different application requirements. He indicated his role was to provide information to CASA, to allow them to assess and approve the display. The DC said that CASA had requested to observe a certain routine in the past, before issuing the display approval. It was therefore the DC’s opinion that it was ultimately CASA’s decision as to whether or not to approve a pilot and their display.
In contrast, several CASA officers reported it was the DO/DC’s responsibility to ensure that a pilot and/or display was suitable, before including them in the application. However, CASA officers also stated that it was ultimately the individual pilot’s responsibility to satisfy themselves that they were capable of conducting the intended display.
The DC reported that he did not necessarily have the opportunity to know each pilot and their display, however he would not invite a pilot that he felt was not suitable to be part of the display. The DC noted that some years certain pilots and/or aircraft were not available but on the whole the applications were similar each year, with just an occasional display name change. Other than inviting the participation of the Mallard, the DC could not recall the last time a new display was introduced.
Ringmaster
The Ringmaster carried out a portion of the DC’s responsibilities as they related to controlling the flying program on the day.
The Ringmaster held a Commercial Pilot (Aeroplane) Licence and was a flight instructor. She reported having been involved in the event for about nine years, first as an observer with the DC in a Caravan, then assisting the previous Ringmaster during one display, before taking on that role. The Ringmaster described her role as coordination of the display aircraft and monitoring them for good separation. She advised she would sometimes offer or approve a request for additional fly-bys where time permitted. The Ringmaster also coordinated the various banner/flag aircraft between displays.
For the 2017 display, the Ringmaster was located in a room on the twelfth floor of a hotel, situated on the northern side of Langley Park that provided a full view of the display area (Figure 11). An assistant located with the Ringmaster provided support in visually monitoring aircraft movements when the Ringmaster was conducting radio communications. The assistant advised he was a flight instructor and had been in that role for the last four or five years.
When the approval for CQA’s third pass was granted by the Ringmaster, the assistant reported that their vantage point and the position of the sun made it difficult to identify exactly what the aircraft was doing over Melville Water (Figure 11) prior to returning to the display area. Although the Ringmaster did not specify the manner in which the Mallard was to return for the third pass, the assistant expected the approach to be via the standard procedure, behind the city, and was surprised when he realised CQA was re-entering Perth Water directly. He reported that CQA may have flown over boats[22] lower than the authorised height, but as the moment had passed, there was no gain in immediately contacting the pilot about it. The Ringmaster advised that she did not observe CQA until just prior to the accident as she was communicating with a banner‑towing helicopter via radio.
Figure 11: The view of Langley Park from the Ringmaster’s vantage point
Source: City of Perth
The Ringmaster had a copy of the Instrument, emergency contact list and display schedule with her on the day. The display schedule contained basic detail of the actual display routines, however it was reported they were generally similar each year. Further, she did not necessarily know who was on board each aircraft, other than the schedule‑listed pilot. The Ringmaster generally didn’t communicate with pilots during their display, so as not to distract them, but would make a call if there was something unsafe.
Suitability assessment for key roles
The CASA air display manual in effect at the time of the occurrence made limited reference to the suitability or experience required for individuals to hold key roles. The guidance was that the DO should have considerable aviation experience if also assuming the function of the DC, or otherwise appoint a suitably qualified person, preferably with display experience. There was no mechanism detailed for assessing the suitability of individuals for the roles and no additional training or accreditation.
By contrast, the Civil Aviation Authority United Kingdom (CAA UK) published Civil Aviation Publication (CAP) 403 Flying Display and Special Events: A Guide to Safety and Administrative Arrangements. CAP 403 provided detailed information about the roles and responsibilities of event organisers and participants. From 1 May 2017, the UK CAA implemented Flying Display Director (FDD)[23] accreditation. The accreditation scheme required the applicant to ‘demonstrate their knowledge, experience and capability against a number of FDD competencies’ including:
regulatory compliance
maintaining flying discipline
risk management
‘understanding of human factor influence on the safety of flying displays’.
The applicant was also required to undergo behavioural and attitudinal fitness assessments.
If successful, the FDD would be authorised to an appropriate tier level, based on degree of display complexity, for a period of three years and must maintain currency for re-accreditation. The United States and New Zealand had similar programs to ensure the knowledge and suitability of the person primarily responsible for coordinating the event.
The CAA UK also required formal evaluation of potential display pilots and their intended routine. This involved having an authorised Display Authorisation Evaluator (DAE) evaluate and mentor a pilot, at which point the pilot can apply for a Display Approval (DA), which was required to participate in a CAA UK authorised event.
Similar to the FDD, to be granted a DA a pilot was required to undergo behavioural and attitudinal assessment to determine their suitability for a flying display role. The pilot’s DA was aircraft type and routine-specific. These accreditation requirements were established in the mid-1980s, with additional restrictions and formalised training introduced after the 2015 Shoreham Air Show accident (see the section titled Related occurrences). As with the FDD role, currency and re‑evaluation was required for re‑validation of the DA. At the time of writing, the United States had a similar pilot evaluation program for aerobatic pilots.
Additional guidance was provided by the CAA UK publication, CAP 1047 Civil Air Displays – A guide for pilots. This publication was ‘intended to provide advice to display pilots to help them avoid the pitfalls which have been experienced in the past’. Topics included personal fitness, planning and practicing for displays, and what to do on display day.
CASA approval and oversight of air displays
Regulations and guidance material
Australia’s Civil Aviation Act 1988, through the Civil Aviation Regulations (CARs) and Civil Aviation Orders (CAOs), provides CASA with the authority to regulate exhibitions of flying, commonly referred to as air displays, flying displays or airshows involving civil aircraft.
CAR 156 and CAO 29.4 cover the regulatory requirements as they relate to air displays. CAR 156 relates to flying over public gatherings. CAO 29.4 outlines the application process and specifies the conditions of approval, planning and control requirements. The order states that an air display shall not be conducted without the written approval of CASA and that the organiser shall be responsible for ensuring that the applicable regulations are met.
CASA also developed the Air Display: Safety and Administrative Arrangements (air display manual) as guidance material to be read in conjunction with the regulations.
Air Display Manual
The air display manual provided guidance on the minimum safety and administrative procedures necessary to run an air display. It outlined the responsibilities of key personnel involved in an air display, including that of the DO, DC and display pilot (flight crew) (see the section titled Air display roles and responsibilities). The guidance in effect at the time of the display approval process was version 1.3 (November 2010). While the air display manual contained detail with respect to responsibilities of the DOs, it was limited in guidance with respect to assessing an application to an expected standard.
In comparison with other jurisdictions, the United States FAA order 8900.1 Volume 3, Chapter 6, Section 1 contained detailed guidance around processing and assessing applications for aviation events (including air displays) to determine whether to issue a certificate of waiver or authorisation to an applicant.
At the time of the occurrence, a revised air display manual had been drafted. Subsequently, version 2.0, significantly revised and renamed the Air Display Administration and Procedure Manual, was published in September 2017, with version 3.0 published in April 2018.
Receipt and processing of air display applications
Applications to conduct air displays were generally submitted to the local regional CASA office, using Form 696 Application for approval to conduct an airdisplay, along with supporting documentation. After assessment of the application, the officers provided advice in the form of a ‘reason for decision’ to the authorised CASA delegate. If approved, the delegate then issued an Instrument under CAO 29.4, identifying the person, or organisation, authorised to conduct the air display. This Instrument formed the approval and permission to conduct the air display, including any CASA‑imposed conditions.
As part of this investigation, the ATSB reviewed Skyworks display approvals conducted by the Western Region (Perth) office, as well as those for the Great Eastern Fly-In conducted by the sport aviation office between 2015‑2017.
Staff in both the Perth and sport aviation offices developed forms or checklists to assist the display approval process. The Perth office developed an ‘Air Display Energy Management’ form, which was used in the 2015‑2017 air display documentation to provide detail for some aerobatic and specialised displays. The form was titled ‘CASA Western Region – Air Display Form’ and had provision for ‘participant’ and ‘DC’ signatures. However, none of the ‘Energy Management’ forms reviewed had been endorsed by the DC.
The sport aviation office developed a spreadsheet to monitor air display pilots’ medicals, licence and endorsements, and aircraft registrations and airworthiness categories. This office also developed a risk assessment document for DOs to complete and submit with their application, and a checklist to monitor the progress and requirements of the approval process. It was reported these additional measures were implemented to ensure consistency and standardisation of the sport aviation office approval process.
The region-specific documents were not referenced in the air display manual nor disseminated more widely. Additionally, the Perth and sport aviation offices were also unaware of the documentation each other had developed.
Air display surveillance
The CASA Western region office increased their involvement in the 2017 air display in response to a drone sighting in Perth Water and a near-collision involving display aircraft, just outside Area Alpha, during the 2016 event.
The office initiated a surveillance activity, which included ramp checks [24] at Jandakot Airport before the air display, and observations of the City of Perth and Police coordination centre and Ringmaster locations. CASA advised the DC of these planned activities in early January 2017 and subsequently met to discuss the purpose of the activities and to address concerns of the DC that the surveillance activity may distract the involved pilots.
After CASA staff escalated the DC’s concern internally, the decision was made to continue with the planned surveillance activities as there had not been any formal surveillance of the event for a significant time period, and the staff understood that the upcoming version of the air display manual would require such activity in the future.[25]
CASA officers attended Jandakot Airport on 26 January 2017, from 1330 until about 1630. The surveillance included a series of ramp checks, observation of formation briefs and general liaison with participants. Due to the proximity of the ramp checks to the display, there was reported concern among the DC, Ringmaster and some of the air display pilots that the checks may have caused stress or distracted pilots immediately prior to flying.
It was reported to the ATSB that the pilot of CQA elected to depart from Serpentine Airfield (instead of Jandakot Airport) to avoid the surveillance activity. While that could not be verified, departure from Serpentine meant there was no opportunity for either CASA, the DC or the pilot of MOX to observe or engage with the pilot prior to the display.
While the Perth office reported they generally attended the pre-display briefings, they did not have a policy to observe, and did not routinely attend the air display. By contrast, the CASA sport aviation office regularly attended the air displays they approved. They reported that this allowed them to observe that the requirements of the display authorisation were being upheld and provided assurance that the documented Instrument was relevant. In addition, the sport aviation office reported that regular attendance of air displays fostered good cooperation with organisers and participants.
Air display risk management and governing framework
Defining risk management
International Standard ISO 31000:2018 Risk management – Guidelines defines risk as the ‘effect of uncertainty on objectives’. That is, deviation from the expected. Risk management is defined as ‘coordinated activities to direct and control and organization with regard to risk’. Some of the key risk management principles include that it:
be integrated into organisational (or in this case, event-based) activities
provide a structured and comprehensive approach, allowing consistent and comparable results
be dynamic, as risks can emerge or change as the context changes
use the best available information, so that both historical and current information from all stakeholders can inform the risks.
The risk management process in ISO 31000:2018 is outlined in Figure 12, and defined as involving:
…the systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing and reporting risk.
This process is designed to be an ‘integral part of management and decision making’ and can be applied at any level including operational matters.
Figure 12: The risk management process
Source: International Standard ISO 31000:2018 Risk Management - Guidelines
The elements of this risk management process relevant to air display preparation, included:
Communication and consultation: where relevant expertise is brought together to ensure the right information is considered when identifying, assessing and controlling risk. In this case, the input of stakeholders such as the City of Perth, DC, Ringmaster, CASA and the display pilots.
Scope: In the context of an air display, the scope should include all activities that may affect the safety of the flying operations.
Risk identification: the purpose of risk identification is to ‘find, recognise and describe risks that might help or prevent’ the desired outcome. In this context, it is important that regulators and DOs consider potential threats, indicators of emerging risks (for example, late inclusion of a new display), limitations of knowledge and time-related factors.
Risk treatment: the purpose is to ‘select and implement options for addressing risk’, including whether a certain risk is to be avoided, changed, shared or retained. Relying on individual pilots to manage their own risks when taking part in an air display is a limited treatment strategy, but combined with more systematic approaches and the collective knowledge of others allows for improved identification of defences.
There is further guidance about the risk management process in ISO 31000:2018 and the September 2017 CASA air display manual.
The concept of a risk framework
As outlined in ISO 31000:2018, a framework for managing risk is designed to ‘assist [organisations] in integrating risk management into significant activities and functions’ for good governance. ‘Framework development encompasses integrating, designing, implementing, evaluating and improving risk management’ across an organisation or group of people.
The United Kingdom (UK) Department for Transport commissioned a study in response to a recommendation from the UK Air Accident Investigation Branch investigation of the 2015 Shoreham accident (see the section titled Related occurrences). The resulting report, A Review of UK civil flying display and special event governance, discussed the concept of governance and how it can range from structured to informal in nature. A governance framework was described as providing ‘an organisation or a group of individuals with common objectives, and reflects the interrelated relationships, factors and other influences on them’. The report stated that good governance should:
provide a set of processes and procedures to deliver clear direction and oversight to industry
distil down specific roles, accountabilities and communications, and
provide a feedback loop that can identify trends and respond to changing circumstances, challenges and regulatory needs.
A visual representation of such a framework, based on good governance principles, was developed to review the UK civil aviation flying display activities, existing around the time of the Shoreham accident. It depicted interactions between the government, the CAA UK and industry (Figure 13). It defined the governance infrastructure as the ‘people, processes and systems to manage day to day activity and reporting’. The top half of the diagram shows those activities that the CAA UK have primary responsibility for defining, developing and participating in, including:
performance – including monitoring of safety performance indicators, and conducting audits
strategy – including reviewing and updating legislation
organisation – including defining the roles of those organising the air display, accrediting the display organisers and briefing display pilots
talent – including developing CAA UK staff skills, mentoring display pilots and shadowing display organisers
The bottom half outlined the areas to be delivered by industry, where the CAA’s responsibilities were more related to understanding, oversight and monitoring (rather than active involvement). This included the planning of the display, the operations themselves, and compliance with regulations.
Throughout this, the CAA UK is also responsible for establishing a risk management framework, including the application of a risk assessment process, auditing flying displays, and setting a risk matrix applicable for flying displays.
Figure 13: United Kingdom civil flying display governance framework
Source: Helios, 2018
Risk management for air displays
In April 2016, CASA convened a working group to update the air display manual. That group identified that the risk assessment process was likely an appropriate and effective tool for the assessment of air display approvals. Despite that, the air display manual in effect for the 2017 air display did not include a requirement to complete a risk assessment as part of the planning or approval processes. However, the September 2017 version of the Manual included a requirement for the DO to ‘compile and conduct [a] risk assessment’, and provided comprehensive guidance in an appendix.
As previously mentioned, the CASA sport aviation office advised that they expected DOs to include a risk assessment as part of their application. An example reviewed by the ATSB for the Great Eastern Fly-In included risks associated with a range of operational activities, including flight and group operations, maintenance, display pilot matters and airspace.
In reviewing other States’ requirements for their air displays, the ATSB noted that the Civil Aviation Authority of New Zealand (CAA NZ) included in their Advisory Circular AC‑91‑1 Aviation Events that the organiser was expected to risk assess the activity. They add that:
The responsibility of implementing and monitoring risk removal and risk mitigation steps falls to the organiser, flying display director and flying display committee. They should therefore all be involved in the risk assessment of the aviation event.
Similarly, the CAA UK CAP403 Flying Display and Special Events: Safety and Administrative Requirements and Guidance outlined that ‘risk assessment is an essential element in the production of any safety plan…Flying Display applicants are required to submit information about any risks that will be actively managed during the event to CAA as part of the display application process’.
Skyworks risk management activities
The City of Perth developed a risk management plan, covering activities associated with the events and coordination around Skyworks, including the air display. It outlined key responsibilities for stakeholders and the tools that were used to identify, assess and control risk. One of these tools was a risk register, which included a number of aviation-related risks such as ‘aircraft/skydive incident causing injury or ill health’. The mitigation for that risk included the provision of the air display approval, and proposed surveillance, from CASA, a landing area exclusion zone and an emergency response plan. The DC provided input into this risk management plan or risk register. Risks identified from previous years’ events included the effects of falling debris, an ‘aircraft incident on Perth Water’, particularly among the moored boats, and skydivers landing in unintended areas.
A near‑collision occurred during the 2016 air display involving a banner tow aircraft and a group of display aircraft, just outside of Area ALPHA. The occurrence prompted the DC, in late January 2016, to request that CASA assist with a modification to area ALPHA for the 2017 display, to reduce the risk of a repeat occurrence. In conjunction with Airservices Australia, CASA’s Office of Airspace Regulation requested that the DC complete a risk assessment, relating to the proposed airspace changes for the 2017 display. The DC questioned the need for the risk assessment when it had not been required previously. In addition, the DC advised CASA he would sign a risk assessment that CASA prepared, when he returned from an overseas trip in November 2016. In response, CASA encouraged him to develop it as a ‘living document’ rather than rely on his experience in the conduct of the air display and examples of risks were provided to the DC. A completed risk assessment (limited to the scope of airspace changes) was ultimately supplied to CASA and the airspace changes were authorised.
In the lead-up to the air display, the CASA Perth office liaised with the DC on some concerns such as the draught of the Mallard in the water and the single‑engine performance. However, apart from the requested risk assessment relating to airspace matters, there was no formal or systematic way that other types of operational risks were identified, assessed and controlled. There was also no requirement to do so under the current regulations.
Related occurrences
Within limitations of the ATSB occurrence database, there were approximately 22 air display‑related occurrences in the ATSB database between 1969 and 2017. Thirteen of those occurrences resulted in a fatality, therefore averaging one fatal accident every 3.7 years. The majority of the occurrences were related to aircraft handling, resulting in loss of control and collision with terrain.
The ATSB also reviewed other states’ investigations into air display accidents, particularly those involving passengers and/or spectators. The scope of the review was to gain appreciation of risk factors to spectators, and where lessons learned had resulted in improvements to the planning and approval of air displays. A number of occurrences were identified and two of these are discussed below.
United Kingdom
The Air Accidents Investigation Branch, United Kingdom investigated the accident involving Hawker Hunter T7, registration G-BXFI near Shoreham Airport on 22 August 2015. The aircraft crashed on to the Shoreham Bypass while performing at the Shoreham Airshow, fatally injuring 11 road users and bystanders. A further 13 people, including the pilot, sustained other injuries.
Beyond examining the actions of the pilot, the investigation found that:
…the parties involved in the planning, conduct and regulatory oversight of the air display did not have formal safety management systems in place to identify and manage the hazards and risks. There was a lack of clarity about who owned which risk and who was responsible for the safety of the air display, the aircraft, and the public outside the display site who were not under the control of the show organisers.
The regulator believed the organisers of air displays owned the risk. Conversely, the organiser believed that the regulator would not have issued an approval for the display if it had not been satisfied with the safety of the event…and the display organiser believed that it was the responsibility of the operator or the pilot to fly the aircraft's display in a manner appropriate to the constraints of the display site.
No organisation or individual considered all the hazards associated with the aircraft’s display, what could go wrong, who might be affected and what could be done to mitigate the risks to a level that was both tolerable and as low as reasonably practicable.
Controls intended to protect the public from the hazards of displaying aircraft were ineffective.
Additional detail in the report included consideration of risk to spectators outside the event, non‑participants (general public in the area) and proximity of residential, industrial and recreational areas, including schools and hospitals.
United States
On 16 September 2011, an experimental single-seat North American P-51D collided with terrain while participating the National Championship Air Races in Reno, Nevada. The pilot and 10 people on the ground sustained fatal injuries and at least 64 others were injured. The National Transportation Safety Board (NTSB) investigation identified the aircraft was conducting a turn just prior to the loss of control. The NTSB made several recommendations, including evaluation of the course design and safety areas to minimise manoeuvring near, and potential conflicts with, spectators. The event organiser subsequently relocated the course and primary spectator area to ‘create and maintain a greater distance’ between the racers and spectators.
Following two low fly-bys along the Langley Park foreshore as part of the City of Perth Australia Day Skyworks event, the pilot of Mallard VH‑CQA (CQA) manoeuvred his aircraft in order to conduct a third pass. During the final positioning turn, CQA rolled left, pitched nose‑down and collided with water. The pilot and passenger were fatally injured, and the aircraft was destroyed. This analysis will examine the:
loss of control
pilot’s actions in returning to the display area for a third pass
carriage of a passenger
regulatory framework for approval and oversight of air displays.
As part of the analysis, comparisons have been drawn with other country’s regulations, guidance and practices as a means of benchmarking other methods for managing air displays. Other countries have also published extensive guidance material and some have dedicated air display organisations to support those organising and participating in air displays.
Loss of control
Analysis of recorded flight and video data, and witness reports identified that the aircraft stalled in the positioning turn for the third pass. Such a loss of control in this aircraft type at the relatively low operating altitude meant the situation was unrecoverable before contact with the shallow water.
Technical examination of the aircraft did not identify anything that contributed to the accident. In the absence of a problem with the aircraft, the stall most likely resulted from a handling error and there were several factors that increased the risk of that occurring.
The pilot had limited recent experience operating the Mallard and had not previously participated in a display involving low-level turns within a confined area. Considering this, and noting the limited opportunity available due to his late inclusion and licencing issue, the pilot had not practiced for the event.
The pilot’s lack of familiarity was intended to be mitigated by following another participating aircraft, VH‑MOX (MOX), during the display sequence and having a pilot familiar with the display present in CQA. These defences were not effective however, as CQA parted company from MOX prior to returning to the display area in a different manner to that associated with the first two passes and there was no accompanying pilot on board CQA during the flight.
Additionally, although current and recent in accordance with the regulations, the pilot had not undergone any formal training in the Mallard in the five years since his endorsement and had satisfied the intervening biennial flight review requirement in a different aircraft type. This was despite the Mallard being a type-rated aircraft, considered as having performance or handling techniques that warranted specific training and flight reviews. The lack of assessment in the Mallard since endorsement was a missed opportunity to objectively confirm the pilot’s competency, or identify and correct any degraded skills specific to operation of that aircraft.
Finally, although not a requirement, the aircraft was not fitted with a stall warning device that may have alerted the pilot to the developing situation in sufficient time to take corrective action.
There was insufficient evidence to establish the extent to which any of these factors influenced the development of the accident. Similarly, the degree to which a focus on participating in the event may have distracted the pilot from operating the aircraft could not be determined.
Returning for the third pass
The pilot of MOX only conducted the two planned passes and was unaware of the intention for a third by CQA until it was requested of the Ringmaster. This impromptu action was contrary to the briefed plan that the two aircraft would fly in company to mitigate against potential issues with the pilot of CQA’s unfamiliarity with the display.
After completing the second display pass, MOX departed the display area bound for a return to Jandakot Airport, followed by CQA. By the time CQA turned to return for the third pass, it was well inside Melville Water. On approving the third pass, the Ringmaster did not offer any direction regarding its conduct and the pilot elected to track directly back to Perth Water. The return to the display area was conducted at low altitude over the built-up area of The Narrows and moored watercraft, which was a deviation from the display approval.
Although not observed by the Ringmaster, the assistant assessed that CQA may have passed over boats below the authorised height during the return for a third pass. However, because CQA had then effectively joined the downwind leg of the accepted orbits over Perth Water, no immediate action was considered necessary.
Left orbits in the Mallard within the confines of Perth water were possible while adhering to the display conditions. However, the requirement to remain clear of the spectators, including watercraft, meant that the area was relatively confined. As a result, manoeuvring within the display area, as opposed to entering it in the prescribed manner around the city, required turns at higher bank angles and lower altitudes, which reduced the margin for error. Had CQA re-entered the display area using the standard procedure, the manoeuvres required to position for the pass would have been relatively benign and significantly reduced the risk of mishandling the aircraft.
Pilot decision making
Nature of decision-based errors and motivational factors
In considering whether the pilot’s actions in returning for the third pass were reasonable to him at the time, it is useful to consider the nature of decision-based human error. One such example, knowledge-based mistakes, are defined as ‘errors brought about by a faulty plan or intention’. They arise in novel situations with ‘resource limitation (bounded rationality) and incomplete or incorrect knowledge’ (Reason, 1990) and likely arise from a lack of appreciation of potential consequences (Harris, 2011). Knowledge-based mistakes can be significantly influenced by certain ‘performance shaping factors’ (O’Hare, 2006). These can be external factors, such as environmental conditions, equipment design and procedures, or internal factors, such as a pilots’ emotional state, physical condition, stress, experience, and task knowledge.
As discussed, the pilot was not well-prepared for the planned display. Additionally, although the pilot attended the pre-display briefing and had access to the display procedures, CQA had likely only ever planned to follow MOX and therefore it is possible that the pilot placed less emphasis on familiarisation with the complete display conditions and procedures. These factors may have contributed to a level of unfamiliarity with the task that resulted in the pilot flying the display with an incomplete or incorrect knowledge and/or appreciation of the potential consequences.
As part of the investigation, the ATSB also considered the motivational effects of being part of event such as an air display. The pilot was reportedly enthusiastic about being involved and was known to enjoy displaying what was a unique and interesting aircraft. While it is difficult to quantify the effect of the pilot’s emotional state in this occurrence, these elements have the potential to influence pilot behaviours, which is reflected by the inclusion of display pilot attitudinal assessments in other jurisdictions.
Handling human factors considerations in air displays: other countries
The human factors considerations of air displays is a topic that has gained more traction in recent years. As part of the Civil Aviation Authority United Kingdom (CAA UK) response to the Shoreham accident findings (one of which required them to undertake a study of error paths that lead to flying display accidents), a workshop called Human Factors in Flying Displays was held in 2017, and attended by about 35 DOs and pilots. One of the topics of discussion was the ‘personal qualities and characteristics of display pilots’ and the DOs. Boundaries between ‘confidence and arrogance’ were discussed, and the importance of promoting learnings and good practices among display pilots.
Additionally, the CAA UK-commissioned study authored by Butler and others (2018) raised some considerations for the future, finding that:
the processes related to the assurance of the competence of air display pilots was a recurring contributory factor highlighted in accident reports. These included training, supervision, practical experience and assessment.
They included a recommendation in their report for display pilots to undertake human factors training, provided by the CAA UK to ‘ensure there is an exchange of expertise across the display community’.
Other States have recognised the need to improve air display pilots’ overall proficiency. For example, the Federal Aviation Administration (FAA), United States, established the Aerobatic Competency Evaluation (ACE) program where pilots must obtain a Statement of Aerobatic Competency (SAC) card prior to conducting aerobatics, or other defined manoeuvres. The FAA delegated the ACE program to the International Council of Air Shows (ICAS), subject matter experts.[26] ICAS published the Air Show Performers Safety Manual to ‘help establish an understanding of the risk factors attendant to air show performances’.
Summary
While the precise reasons for the pilot’s actions will remain unknown, there were several factors that may have influenced the pilot’s decision making, and which reinforce the importance of planning and practicing for displays. A safety message was highlighted in the CAA UK’s guide for display pilots, which emphasised:
Never be tempted to make unrehearsed changes to your display routine and do not undertake any manoeuvres you have not practiced….Stick to your planned routine but always be prepared, particularly at hot and high displays, for reduced aircraft performance…Never press on into a manoeuvre with less than ideal start conditions.
Carriage of a passenger during the display
Participation in an air display is a specialised aviation activity that frequently involves flying the aircraft in a non‑standard manner and in unique locations. As such, there is an increased risk associated with this type of flying and for this reason passengers are not permitted to take part.
This requirement was clearly stated in the conditions of the display. The pilot had also received the display briefing the night before, reinforcing this condition. Additionally, the pilot had previously been informed by staff from the Civil Aviation Safety Authority (CASA) that the person carried was a passenger and was not considered as crew for the purpose of an air display. Despite this, he carried this passenger during the Perth display, which increased the severity of the accident outcome.
Regulatory framework for approval and oversight
According to the International Standards ISO 31000:2018 Risk management – Guidelines and a review of the UK CAA’s approach towards air displays, good governance in this context comes from activities such as:
having processes and procedures for the industry and the regulator to work by
clearly delineating and providing guidance in the roles and responsibilities of organisers and pilots
monitoring safety performance of those involved in the planning and preparation of the air display including ensuring that regulator staff are adequately prepared.
The regulator’s responsibilities are met by ensuring there are the right ‘people, processes and systems to manage day to day [air display] activities and reporting’ (Helios, 2018).
With respect to air displays in Australia, although certain regulatory processes did exist, CASA did not have an effective framework to consistently approve and oversight air displays. This was predominantly due to the following factors, which increased the likelihood that key safety risks associated with the conduct of the air display would not be adequately managed. It could not be determined whether the regulatory framework in place at the time of the accident contributed to it.
Air display approval guidance
The CASA‑published manual, Air Displays: Safety and Administrative Arrangements (air display manual) to provide ‘guidance on the minimum safety and administrative procedures necessary to run such an event’. However, there was no comprehensive guidance for the assessment of an air display application or oversight of the event, including the expected standard for certain criteria.
While those assessing the applications had shared their methodology and local knowledge within their office, this information was not readily accessible to all offices. As regional offices sought to independently ensure completeness and standardisation of their assessment processes, they developed local procedures, forms and checklists. Variability in assessment and approval practices increases the likelihood of applying an inconsistent process or standard to the task, increasing the risk that key safety aspects may be overlooked.
In contrast, both the FAA and CAA UK published documents that provided their staff with specific guidance and processes for assessing and approving an air display, which in turn provides some assurance of standardisation.
Roles and responsibilities
Air displays require careful management and coordination. The scale and complexity may differ, but any lack of clarity around key roles will affect how well they are managed. The roles of the display organiser (DO) and display coordinator (DC) are vital to the planning and safe operation of each air display. For this display, the roles were not clearly or consistently defined and there were differences in the understanding of who held those roles, exactly what their responsibilities were or the standard those responsibilities were expected to be carried out. This meant that key, safety‑related elements of the air display planning and oversight were more likely to be overlooked.
These points indicated that CASA’s processes were not effective in ensuring that key personnel were fully aware of their responsibilities or that they were suitably equipped to carry them out to the expected standard. By comparison, the CAA UK, FAA and CAA NZ have all established accreditation programs for persons taking on the role of the DO or DC (or equivalent roles). While the accreditation process varies between countries, the concept is similar. In addition to requiring knowledge of the regulations and role responsibilities, the candidates are individually assessed for suitability including behavioural and attitudinal fitness for the role. Essentially, the accreditation program is designed to provide organisers, and in some cases participants, with the knowledge and skills to effectively and safely plan and coordinate and/or participate in an air display. As such, it provides necessary assurance to regulators that the roles will be carried out with consistency and to the expected standard.
Identification and treatment of risk
The risk management process is designed to be an ‘integral part of management and decision making’ (ISO, 2018) for an event such as an air display. If organisers and regulators take the opportunity to systematically identify, assess and treat risks, it is possible to reduce the impact of hazards on the safety of the event. The application of the risk management process will not, in all likelihood, capture every possible risk, but the process can trigger identification and validation of those that are foreseeable, and prioritise their treatment. In particular, it increases the chances that changes, such as the late inclusion of an unfamiliar pilot in the air display, can be considered in terms of the potential introduced risk.
The air display manual current at the time of the accident was the main reference for organisers however, it did not include a requirement for any risk management activities to be done. It was therefore less likely that CASA staff (unless requiring a risk assessment as part of their local procedures) involved in the approval and oversight of air displays were in a position to review organisers’ perceptions of operational risks, or apply systematic methods of risk management.
In this case, CASA identified a number of safety-related risks, such as the pilot not having the appropriate endorsement on the Mallard and the benefit in having the DC on board CQA to mitigate against the pilot’s inexperience. However, these were not identified through any systematic means, and the treatment measures were sometimes not implemented (for example, the DC was not on board CQA for the display), or had other unintended consequences (authorising the pilot’s participation two days out from the display significantly limited his available time to prepare and practice). These examples, plus the absence of any documented processes or any requirements for the staff organising air displays to use systematic risk management methods, reduced the chances that identified risks were going to be treated adequately and controls implemented.
It is noted that CASA has revised the air display manual since this accident to include a requirement for a formal risk assessment to be completed by DOs, which reflects the best-practice approach to identifying and controlling display risks (see the section titled Safety issues and actions). However, using a risk-based approach for the assessment and approval process itself would probably provide additional safety benefit.
From the evidence available, the following findings are made regarding the loss of control and collision with water involving the G-73 Mallard aircraft, registered VH-CQA 10 km west‑south‑west of Perth Airport, Western Australia on 26 January 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The pilot returned the aircraft to the display area for a third pass in a manner contrary to the approved inbound procedure and which required the use of increased manoeuvring within a confined area to establish the aircraft on the display path.
During the final positioning turn for the third pass, the aircraft aerodynamically stalled at an unrecoverable height.
The pilot's decision to carry a passenger on a flight during the air display was contrary to the Instrument of Approval issued by the Civil Aviation Safety Authority for this air display and increased the severity of the accident consequence.
Other factors that increased risk
The Civil Aviation Safety Authority (CASA) did not have an effective framework to approve and oversight air displays, predominantly due to the following factors:
While the Air Display Manual provided guidance to organisers conducting an air display, it did not inherently provide the processes and tools needed for CASA to approve and oversee one and no other documented guidance existed.
Unlike the accreditation models adopted by some other countries, CASA did not have a systematic approach for assessing the suitability of those responsible for organising, coordinating and participating in air displays.
CASA did not have a structured process to ensure that risks were both identified and adequately treated.
The combination of these factors significantly increased the likelihood that safety risks associated with the conduct of the air display were not adequately managed. [Safety issue]
Safety issues and actions
The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The Civil Aviation Safety Authority (CASA) did not have an effective framework to approve and oversight air displays, predominantly due to the following factors:
While the Air Display Manual provided guidance to organisers conducting an air display, it did not inherently provide the processes and tools needed for CASA to approve and oversee one and no other documented guidance existed.
Unlike the accreditation models adopted by some other countries, CASA did not have a systematic approach for assessing the suitability of those responsible for organising, coordinating and participating in air displays.
CASA did not have a structured process to ensure that risks were both identified and adequately treated.
The combination of these factors significantly increased the likelihood that safety risks associated with the conduct of the air display were not adequately managed.
Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority undertake further work to enhance their tools and guidance for air display approval and oversight, and procedures to ensure the suitability of those responsible for organising, coordinating and participating in air displays.
Sources and submissions
The sources of information during the investigation included the:
Civil Aviation Safety Authority
Air Accidents Investigation Branch and Civil Aviation Authority, United Kingdom
National Transport Safety Board and Federal Aviation Administration, United States
National Transport Safety Committee, Indonesia
Civil Aviation Authority, New Zealand
International Council of Airshows
Perth Air Display organisers, participants and witnesses
City of Perth
G-73 and other float plane pilots
Bureau of Meteorology
Airservices Australia.
References
AAIB, Aircraft Accident Report AAR 1/2017 – G-BXFI, 22 August 2015, Air Accidents Investigation Branch United Kingdom
ATSB 2009, Avoidable Accidents No.1 Low-level flying, Australian Transport Safety Bureau, Aviation Research and Analysis publication AR-2009-041
Boud and McFarlane, 2018 Review of UK civil flying display and special event governance, Hampshire, United Kingdom
Butler and others, 2018, Human Factors in Air Displays: Transfer of Behaviours and Error Path Study, Health and Safety Laboratory.
CAA UK, Civil Aviation Publication (CAP) 403 Flying Display and Special Events: A Guide to Safety and Administrative Arrangements, Civil Aviation Authority United Kingdom
CAA UK, Civil Aviation Publication (CAP) 1047 Civil Air Displays – A guide for pilots, Civil Aviation Authority United Kingdom
CASA 2017, Air display administration and procedure manual, Civil Aviation Safety Authority
Harris, 2011, Human Performance on the Flight Deck, Ashgage Publishing Ltd, London, United Kingdom
International Standard ISO 31000:2018 Risk management – guidelines, ISO copyright office, Geneva Switzerland.
NTSB, Accident Brief AAB-12/01, Pilot/Race, The Galloping Ghost North American P-51D, N79111, Reno, Nevada, September 16, 2011, National Transport Safety Board
O’Hare, 2006, Cognitive Functions and Performance Shaping Factors in Aviation Accidents and Incidents, The International Journal of Aviation Psychology, pp.145-156
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, the City of Perth, the display coordinator, the ringmaster, the ringmaster’s assistant, the pilot of VH-MOX, the National Transportation Safety Board, the Federal Aviation Administration, the International Council of Airshows, the Civil Aviation Authority United Kingdom and the Air Accidents Investigation Board.
Submissions were received from Civil Aviation Safety Authority, the City of Perth, the display coordinator, the ringmaster, and the pilot of VH-MOX. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
